738 reputation
422
bio website johngraybosch.com
location
age
visits member for 2 years, 5 months
seen yesterday

I'm an Application Developer in Long Island, NY.


Oct
14
awarded  Popular Question
Sep
24
awarded  Autobiographer
Sep
22
awarded  Popular Question
Sep
13
awarded  Popular Question
Aug
11
comment Mitigating SSLStrip by only serving a site over HTTPS?
Thanks. I understand the attack better now. Time to update some sites... lol
Aug
11
revised Mitigating SSLStrip by only serving a site over HTTPS?
added 394 characters in body
Aug
11
accepted Mitigating SSLStrip by only serving a site over HTTPS?
Aug
11
comment Mitigating SSLStrip by only serving a site over HTTPS?
Oh and I get your first paragraph now. Any client HTTP request can be intercepted and proxied, even if the site only supports HTTPS.
Aug
11
comment Mitigating SSLStrip by only serving a site over HTTPS?
Sorry, I meant it as italic, not yelling. Just formatting. Oh, ok, so SSLStrip can't attack you per-se, if you type HTTPS in the address bar, but it can block you. And the confused user might try something different. So if they had HTTPS://www.example.com bookmarked, they might trying typing in example.com in their address bar, and pwned.
Aug
11
comment Mitigating SSLStrip by only serving a site over HTTPS?
I think your first paragraph needs to be reworked to be accurate. It sounds like you're trying to say that the initial HTTP request is vulnerable (before the user has received an HSTS header). On subsequent requests, the browser will not accept an HTTP connection to the site, only an HTTPS connection. PLEASE CLARIFY YOUR FIRST PARAGRAPH TO RECEIVE ACCEPTED ANSWER.
Aug
11
comment Mitigating SSLStrip by only serving a site over HTTPS?
Ok, but this seems to contradict what some responders are saying below. I'm proposing that your site never serves HTTP and that the user types in HTTPS directly in the address bar. You're saying that SSLStrip can redirect the client's browser from HTTPS to HTTP? The responders below seem to indicate that you're safe if you type HTTPS...
Aug
8
asked Mitigating SSLStrip by only serving a site over HTTPS?
Jul
29
awarded  Notable Question
Jul
10
awarded  Popular Question
Jul
8
asked Does ASP.NET guarantee the integrity of a page's controls on a post back?
Jul
2
awarded  Curious
Jun
16
awarded  Popular Question
Jun
12
awarded  Yearling
Apr
4
awarded  Benefactor
Apr
4
accepted WebRTC P2P SSL - Where are the keys generated?