Comment on This is why we have two-factor authentication.
MrKoyun@lemmy.world 2 months agoI mean, we have https now. Also VPNs.
Comment on This is why we have two-factor authentication.
MrKoyun@lemmy.world 2 months agoI mean, we have https now. Also VPNs.
diabetic_porcupine@lemmy.world 2 months ago
You can always use pihole to mess with your local dns and resolve to a fake website that looks like your social media of choice and collect their password
Anivia@feddit.org 2 months ago
Only if the user ignores the “unsafe connection” warning in the browser, since you won’t have an SSL certificate for the domain
diabetic_porcupine@lemmy.world 2 months ago
Hmm good point… you would need the ca to sign off on it self signed doesn’t work… it’s just a file though right? Couldn’t you rip it from the real server?
Anivia@feddit.org 2 months ago
No, that’s not how TLS works. The certificate is not exposed to the internet unless the admins of the webserver are extremely incompetent. That would defeat the entire purpose, not only could you impersonate the server, but the encryption would also be futile since anyone would have access to the private key.