News for hackers. Stuff that matters.

A comment on What we give away when we log on to a public Wi-Fi network. Parent comment

Re:What we give away when we log on to a public Wi-Fi network by huntaub on Saturday October 18, 2014 @10:33PM (#8477046)
Can you clarify the first point more? I would assume that if the user is able to connect to "facebook.com", then the connection would immediately go to HTTPS and the router could not "forcefully redirect" or do anything to the connection.

Alternatively, I could imagine a situation where the router hijacks the _DNS_ request for Facebook to a malicious site. Is that what you were referring to?

[ Parent | on HN ]
Re:What we give away when we log on to a public Wi-Fi network by smtddr on Saturday October 18, 2014 @10:42PM (#8477055)
Don't know if this works still today... but I've definitely used it before: http://www.thoughtcrime.org/software/sslstrip/
[ Parent | on HN ]
Re:What we give away when we log on to a public Wi-Fi network by domenicd on Sunday October 19, 2014 @12:16AM (#8477200)
I think that attack is exactly what HSTS (https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) is meant to solve.
[ Parent | on HN ]