News for hackers. Stuff that matters.

A comment on Why HTTPS Everywhere isn't on addons.mozilla.org. Parent comment

Re:Why HTTPS Everywhere isn't on addons.mozilla.org by blcknight on Wednesday November 26, 2014 @06:53AM (#8661945)
All someone needs to do is hack the AMO servers and change out the XPI -- and no one would no the difference, because the packages aren't signed.

Not to also mention, MITM attacks on the actual SSL connection.

Serving over HTTPS isn't a valid package signing strategy.

[ Parent | on HN ]
Re:Why HTTPS Everywhere isn't on addons.mozilla.org by bzbarsky on Wednesday November 26, 2014 @11:02AM (#8662901)
> Not to also mention, MITM attacks on the actual SSL > connection.

The AMO cert is pinned in Firefox. If you MITM the connection, Firefox will refuse to connect to it.

[ Parent | on HN ]