2 replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
source | link

One other way that HSTS could be compromised would be if you had a root CA installed on the computer that you were connecting from that enabled a MITM attacker to appear to be the original website.

E.g. if you were using a company computer to connect to Gmail, the company could intercept the traffic in the folllowing way:

  • Company computers have a custom root CA installed
  • The custom root CA is used to sign a "bad" certificate for Google
  • Your computer connects to an intermediary device (e.g. firewall) using this "bad" certificate
  • The communication is decrypted, then re-encrypted using the genuine certificate for Google.

See this question How can my employer be a man-in-the-middle when I connect to Gmail? How can my employer be a man-in-the-middle when I connect to Gmail?

One other way that HSTS could be compromised would be if you had a root CA installed on the computer that you were connecting from that enabled a MITM attacker to appear to be the original website.

E.g. if you were using a company computer to connect to Gmail, the company could intercept the traffic in the folllowing way:

  • Company computers have a custom root CA installed
  • The custom root CA is used to sign a "bad" certificate for Google
  • Your computer connects to an intermediary device (e.g. firewall) using this "bad" certificate
  • The communication is decrypted, then re-encrypted using the genuine certificate for Google.

See this question How can my employer be a man-in-the-middle when I connect to Gmail?

One other way that HSTS could be compromised would be if you had a root CA installed on the computer that you were connecting from that enabled a MITM attacker to appear to be the original website.

E.g. if you were using a company computer to connect to Gmail, the company could intercept the traffic in the folllowing way:

  • Company computers have a custom root CA installed
  • The custom root CA is used to sign a "bad" certificate for Google
  • Your computer connects to an intermediary device (e.g. firewall) using this "bad" certificate
  • The communication is decrypted, then re-encrypted using the genuine certificate for Google.

See this question How can my employer be a man-in-the-middle when I connect to Gmail?

1
source | link

One other way that HSTS could be compromised would be if you had a root CA installed on the computer that you were connecting from that enabled a MITM attacker to appear to be the original website.

E.g. if you were using a company computer to connect to Gmail, the company could intercept the traffic in the folllowing way:

  • Company computers have a custom root CA installed
  • The custom root CA is used to sign a "bad" certificate for Google
  • Your computer connects to an intermediary device (e.g. firewall) using this "bad" certificate
  • The communication is decrypted, then re-encrypted using the genuine certificate for Google.

See this question How can my employer be a man-in-the-middle when I connect to Gmail?