Comment on What is stopping a scammer from HTTPS certificating a "nonsense.ReputableBank.com"
redpotatoes@lemm.ee 10 months ago
They’d need a certificate authority to issue the certificate, and the victim’s browser would have to trust that authority.
over_clox@lemmy.world 10 months ago
I’ve been able to downgrade https sites to plain http sites, through a series of loopholes which I won’t go into.
themoonisacheese@sh.itjust.works 10 months ago
That’s nice, be sure to tell us how it goes when HSTS is enabled
elvith@feddit.org 10 months ago
Checks own servers…
Yeah, I’d like to see that…
over_clox@lemmy.world 10 months ago
web.archive.org/web/…/7667184419.html
Anything on the archive can be accessed via simple http, regardless of whether the original site was https or not.
Serinus@lemmy.world 10 months ago
So you’ve… compromised your own security. Grats?
over_clox@lemmy.world 10 months ago
My own security? Hah, that’s a joke right?
Everything on the Internet Archive can be accessed via simple http, even if the original archived site was https.
Serinus@lemmy.world 10 months ago
All that does is allow someone in the middle to potentially read your traffic. So what’s secret about the traffic between you and the Internet archive? If it’s only your login details, that seems like a you problem.
It wasn’t long ago that most of the internet was http only.