Comment on What is stopping a scammer from HTTPS certificating a "nonsense.ReputableBank.com"

redpotatoes@lemm.ee ⁨4⁩ ⁨days⁩ ago

• over_clox@lemmy.world ⁨4⁩ ⁨days⁩ ago

  I’ve been able to downgrade https sites to plain http sites, through a series of loopholes which I won’t go into.

  source

  • themoonisacheese@sh.itjust.works ⁨4⁩ ⁨days⁩ ago

    That’s nice, be sure to tell us how it goes when HSTS is enabled

    source

    • elvith@feddit.org ⁨4⁩ ⁨days⁩ ago

      Checks own servers…

      Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

      Yeah, I’d like to see that…

      source

      • over_clox@lemmy.world ⁨4⁩ ⁨days⁩ ago

        web.archive.org/web/…/7667184419.html

        Anything on the archive can be accessed via simple http, regardless of whether the original site was https or not.

        source

        • -> View More Comments
  • Serinus@lemmy.world ⁨4⁩ ⁨days⁩ ago

    So you’ve… compromised your own security. Grats?

    source

    • over_clox@lemmy.world ⁨4⁩ ⁨days⁩ ago

      My own security? Hah, that’s a joke right?

      Everything on the Internet Archive can be accessed via simple http, even if the original archived site was https.

      source

      • Serinus@lemmy.world ⁨4⁩ ⁨days⁩ ago

        All that does is allow someone in the middle to potentially read your traffic. So what’s secret about the traffic between you and the Internet archive? If it’s only your login details, that seems like a you problem.

        It wasn’t long ago that most of the internet was http only.

        source

        • -> View More Comments