Comment on What is stopping a scammer from HTTPS certificating a "nonsense.ReputableBank.com"

• themoonisacheese@sh.itjust.works ⁨1⁩ ⁨week⁩ ago

  That’s nice, be sure to tell us how it goes when HSTS is enabled

  source

  • elvith@feddit.org ⁨1⁩ ⁨week⁩ ago

    Checks own servers…

    Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

    Yeah, I’d like to see that…

    source

    • over_clox@lemmy.world ⁨1⁩ ⁨week⁩ ago

      web.archive.org/web/…/7667184419.html

      Anything on the archive can be accessed via simple http, regardless of whether the original site was https or not.

      source

      • elvith@feddit.org ⁨1⁩ ⁨week⁩ ago

        Yeah, but now you’re talking about communicating with web.archive.org and not nonesense.reputable-bank.com as in the original post. In this case you’re not even trying to hide the fact, that you aren’t affiliated with reputable-bank.com and were back to square one and you could also just use reputable-bank.com.some.malicious-phishing.website to host your page.

        Btw: all modern browsers will warn you when you access a non-encrypted website - some immediately, some only when you try to enter data into a login form.

        source

        • -> View More Comments
• Serinus@lemmy.world ⁨1⁩ ⁨week⁩ ago

  So you’ve… compromised your own security. Grats?

  source

  • over_clox@lemmy.world ⁨1⁩ ⁨week⁩ ago

    My own security? Hah, that’s a joke right?

    Everything on the Internet Archive can be accessed via simple http, even if the original archived site was https.

    source

    • Serinus@lemmy.world ⁨1⁩ ⁨week⁩ ago

      All that does is allow someone in the middle to potentially read your traffic. So what’s secret about the traffic between you and the Internet archive? If it’s only your login details, that seems like a you problem.

      It wasn’t long ago that most of the internet was http only.

      source

      • over_clox@lemmy.world ⁨1⁩ ⁨week⁩ ago

        Who said I log into anything? I have terabytes of files archived, without any accounts anywhere. I’m not that stupid.

        source