News for hackers. Stuff that matters.

A comment on Why HTTPS Everywhere isn't on addons.mozilla.org. Parent comment

Re:Why HTTPS Everywhere isn't on addons.mozilla.org by click170 on Wednesday November 26, 2014 @10:44AM (#8662787)
Its possible to MITM an HTTPS connection, trick you into thinking it is secure by providing a green lock favicon, and intercepting or sniffing everything you do over that connection. And it will work on nearly every website in existance.

More people should be aware of SSL Strip and how to protect yourself against it.

http://www.thoughtcrime.org/software/sslstrip/

[ Parent | on HN ]
Re:Why HTTPS Everywhere isn't on addons.mozilla.org by bzbarsky on Wednesday November 26, 2014 @11:03AM (#8662909)
> Its possible to MITM an HTTPS connection

Not in the case of Firefox connecting to AMO, because it uses a pinned certificate for that.

[ Parent | on HN ]
Re:Why HTTPS Everywhere isn't on addons.mozilla.org by click170 on Friday November 28, 2014 @04:12PM (#8672191)
Are you sure?

I perform HTTPS interception on all out-bound traffic on my network and I don't recall making an exception for AMO, and I have a number of add-ons installed. Though, it wouldn't be the first time I've forgotten about something like that.

[ Parent | on HN ]
Re:Why HTTPS Everywhere isn't on addons.mozilla.org by bzbarsky on Friday December 05, 2014 @04:19AM (#8703561)
Did you install your addons before updating to Firefox 32? That's when the pinning was introduced.
[ Parent | on HN ]