Tag Info

New answers tagged

-2

Better look for other security issues, yes it can combat SE attacks, But why would you give DO_NOT_give_this_security_thingy_to_anybody_ever to a csrf-token name? make csrf token non-reusable, it'll solve the problem!


-3

Also one thing to consider very carefully, is that certain antiviruses work by scanning the traffic. If the site is using HTTPS, a virus can in fact slip undetected past the radar. This is especially important if you either have a antivirus service provided by your ISP, your employer, or your school, which is based on a "Proxy". This is why some proxies ...


4

The secure from https isn't related to content on a website/service. It is called 'secure' because theoretically the security protocols (ssl/tsl and some others) do not allow the information being exchanged to be easily understood (it encrypts the data flow), so, even if someone would catch your packets, they would have to decrypt it to understand the ...


1

In addition to the other points raised, it's worth mentioning that even a trusted site (for example, your bank), could still be infected by a virus that makes it behave maliciously. So even if you trust the organization, https still does not guarantee that the website doesn't do malicious things.


0

A Pharming attack can be used to redirect your traffic to a malicious server. This server will connect to the legit one and will authenticate on it as if it is you. Then it will present to you the information or web page from the legit server. For you - it will appear as you are connected securely to the legit server but now there is a MITM that has access ...


8

In short: Yes, it can indeed be malicious! Accessing a site via HTTPS means that the connection between your computer and the website's server is encrypted and secure. What HTTPS does Encrypt the data being transmitted over the network between your computer and the website's server to prevent third parties from intercepting it. Prevent man in the ...


3

Yes, it can easily be - malicious JavaScript or viruses can be transferred over HTTPS as easily as over HTTP no problem. It may be somewhat less likely as the source of the valid verified HTTPS message is known. However still may happen if the HTTPS site has had security hole, has been attacked, compromised and malicious content has been installed on it. It ...


1

Add to the list that the CA itself could have been hacked (e.g. DigiNotar) and used to issue fake certificates, or your browser might be forced to use fake CAs specifically so that your connection might be intercepted and tampered with - as is sometimes used on corporate networks. Oh, also the certificate might have been faked because it was using MD5. As ...


33

No, HTTPS does not necessarily mean that a site is not malicious. HTTPS means very little as to the security of a site. It's specifically geared to keep your communication with the site secure from eavesdroppers and tampering, but offers nothing as to the security of the site itself. Yes, a site serving content over HTTPS has a certificate. That means ...


41

Not at all a guarantee. HTTPS means that the web page has SSL, which simply means that your connection to the page is encrypted. The content on the page could be anything that could be posted on any web site whether encrypted by SSL or not.



Top 50 recent answers are included