Comment Comment by panarky > 3. Everything you care about _should_ be going over TLS, which mitigates all effects of this attack.This is probably the biggest misconception.Many, many websites and APIs don't have HSTS enabled to force all connections to use TLS.The author demonstrates using sslstrip to downgrade the connection of match.com to steal credentials.How many people watch the green "secure" indicator in the URL bar to ensure it doesn't change mid-session?How many thousands of apps don't even have such an indicator to observe?How many millions of phones and APs will never get patched?This is a severe vulnerability. parent panarky 9 years ago
This is probably the biggest misconception.
Many, many websites and APIs don't have HSTS enabled to force all connections to use TLS.
The author demonstrates using sslstrip to downgrade the connection of match.com to steal credentials.
How many people watch the green "secure" indicator in the URL bar to ensure it doesn't change mid-session?
How many thousands of apps don't even have such an indicator to observe?
How many millions of phones and APs will never get patched?
This is a severe vulnerability.