News for hackers. Stuff that matters.

A comment on Intent to deprecate: Insecure HTTP. Parent comment

Re:Intent to deprecate: Insecure HTTP by lisper on Tuesday April 14, 2015 @01:07PM (#9375701)
How is that going to help? If you've been MITMd then the attacker can intercept your TACK and Google traffic too.
[ Parent | on HN ]
Re:Intent to deprecate: Insecure HTTP by stouset on Tuesday April 14, 2015 @07:46PM (#9378054)
Chrome pins the Google certs, so MITM will only work if you get the user before they've first downloaded Chrome. And then you have to ensure you only ever MITM those clients, or your attack will be detected.

And TACK literally was designed to solve this problem. If the MITM interferes with you communicating to other TACK clients, you detect their attack. If they don't, you detect their attack.

[ Parent | on HN ]