So you’ve… compromised your own security. Grats?
Comment on What is stopping a scammer from HTTPS certificating a "nonsense.ReputableBank.com"
over_clox@lemmy.world 10 months agoI’ve been able to downgrade https sites to plain http sites, through a series of loopholes which I won’t go into.
Serinus@lemmy.world 10 months ago
over_clox@lemmy.world 10 months ago
My own security? Hah, that’s a joke right?
Everything on the Internet Archive can be accessed via simple http, even if the original archived site was https.
Serinus@lemmy.world 10 months ago
All that does is allow someone in the middle to potentially read your traffic. So what’s secret about the traffic between you and the Internet archive? If it’s only your login details, that seems like a you problem.
It wasn’t long ago that most of the internet was http only.
over_clox@lemmy.world 10 months ago
Who said I log into anything? I have terabytes of files archived, without any accounts anywhere. I’m not that stupid.
themoonisacheese@sh.itjust.works 10 months ago
That’s nice, be sure to tell us how it goes when HSTS is enabled
elvith@feddit.org 10 months ago
Checks own servers…
Yeah, I’d like to see that…
over_clox@lemmy.world 10 months ago
web.archive.org/web/…/7667184419.html
Anything on the archive can be accessed via simple http, regardless of whether the original site was https or not.
elvith@feddit.org 10 months ago
Yeah, but now you’re talking about communicating with web.archive.org and not nonesense.reputable-bank.com as in the original post. In this case you’re not even trying to hide the fact, that you aren’t affiliated with reputable-bank.com and were back to square one and you could also just use reputable-bank.com.some.malicious-phishing.website to host your page.
Btw: all modern browsers will warn you when you access a non-encrypted website - some immediately, some only when you try to enter data into a login form.