Re:What we give away when we log on to a public Wi-Fi network
by goblin89 on Saturday October 18, 2014 @05:55PM
(#8476461)
> If you don't type the https url, you start by visiting the http website. Normally the http version will redirect to https, but a man in the middle can easily prevent this.
This is not entirely correct. HSTS[0] was designed to protect against such attacks.
It's true, however, that not every browser out there supports it yet, and you must visit the website at least once without MITM for the server to successfully communicate HSTS header. (In Chrome certain domains are included in built-in list[1], though.)
This is not entirely correct. HSTS[0] was designed to protect against such attacks.
It's true, however, that not every browser out there supports it yet, and you must visit the website at least once without MITM for the server to successfully communicate HSTS header. (In Chrome certain domains are included in built-in list[1], though.)
[0] https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_s...
[1] https://src.chromium.org/viewvc/chrome/trunk/src/net/http/tr...