Skip to main content
Information Security

Return to Question

replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
Source Link
Community Bot
Community Bot
  • 1

I always thought that if I had an SSL connection there would be no MITM attacks. Now it appears that isn't true (see comments in this question Is it okay from a security perspective to read foreign (untrusted) cookies in a trusted network?Is it okay from a security perspective to read foreign (untrusted) cookies in a trusted network?)

I'm still unsure how it works and whether each browser needs to install a certificate, but it sounds like a proxy on your LAN connection either redirects the domain (I probably misunderstood) or uses an alternative certificate (doesn't the cert need to match the domain? I'm still confused).

Would it be possible to check if I am connected to the true site? It would be helpful too if you can explain how the proxy can create a valid cert for a domain it doesn't have the real cert/keys for. (I know this is two questions but both can potentially be explained by one answer.)

I always thought that if I had an SSL connection there would be no MITM attacks. Now it appears that isn't true (see comments in this question Is it okay from a security perspective to read foreign (untrusted) cookies in a trusted network?)

I'm still unsure how it works and whether each browser needs to install a certificate, but it sounds like a proxy on your LAN connection either redirects the domain (I probably misunderstood) or uses an alternative certificate (doesn't the cert need to match the domain? I'm still confused).

Would it be possible to check if I am connected to the true site? It would be helpful too if you can explain how the proxy can create a valid cert for a domain it doesn't have the real cert/keys for. (I know this is two questions but both can potentially be explained by one answer.)

I always thought that if I had an SSL connection there would be no MITM attacks. Now it appears that isn't true (see comments in this question Is it okay from a security perspective to read foreign (untrusted) cookies in a trusted network?)

I'm still unsure how it works and whether each browser needs to install a certificate, but it sounds like a proxy on your LAN connection either redirects the domain (I probably misunderstood) or uses an alternative certificate (doesn't the cert need to match the domain? I'm still confused).

Would it be possible to check if I am connected to the true site? It would be helpful too if you can explain how the proxy can create a valid cert for a domain it doesn't have the real cert/keys for. (I know this is two questions but both can potentially be explained by one answer.)

English
Source Link
Gilles 'SO- stop being evil'
Gilles 'SO- stop being evil'
  • 52.4k
  • 14
  • 126
  • 184

How do iI check mythat I have a direct SSL connection is directly to a website?

I always thought that if iI had an SSL connection there willwould be no MITM attacks. Now it appears that isn't true (see comments in this question Is it okay from a security perspective to read foreign (untrusted) cookies in a trusted network?)

I'm still unsure how it works and ifwhether each browser needs to install a certificate, but it sounds like a proxy on your lanLAN connection either redirects the domain (iI probably misunderstood) or uses an alternative certificate (doesn't the cert need to match the domain? i'mI'm still confused).

Would it be possible to check if iI am connected to the true site? It would be helpful too if you can explain how the proxy can create a valid cert for a domain it doesn't have the real cert/keys for. (I know itsthis is two questions but both can potentially be explain withexplained by one answer.)

How do i check my SSL connection is directly to a website?

I always thought that if i had an SSL connection there will be no MITM attacks. Now it appears that isn't true (see comments in this question Is it okay from a security perspective to read foreign (untrusted) cookies in a trusted network?)

I'm still unsure how it works and if each browser needs to install a certificate but it sounds like a proxy on your lan connection either redirects the domain (i probably misunderstood) or uses an alternative certificate (doesn't the cert need to match the domain? i'm still confused).

Would it be possible to check if i am connected to the true site? It would be helpful too if you can explain how the proxy can create a valid cert for a domain it doesn't have the real cert/keys for. (I know its two questions but both can potentially be explain with one answer)

How do I check that I have a direct SSL connection to a website?

I always thought that if I had an SSL connection there would be no MITM attacks. Now it appears that isn't true (see comments in this question Is it okay from a security perspective to read foreign (untrusted) cookies in a trusted network?)

I'm still unsure how it works and whether each browser needs to install a certificate, but it sounds like a proxy on your LAN connection either redirects the domain (I probably misunderstood) or uses an alternative certificate (doesn't the cert need to match the domain? I'm still confused).

Would it be possible to check if I am connected to the true site? It would be helpful too if you can explain how the proxy can create a valid cert for a domain it doesn't have the real cert/keys for. (I know this is two questions but both can potentially be explained by one answer.)

Tweeted twitter.com/#!/StackSecurity/status/199276128395997184
Source Link
user5575
user5575

How do i check my SSL connection is directly to a website?

I always thought that if i had an SSL connection there will be no MITM attacks. Now it appears that isn't true (see comments in this question Is it okay from a security perspective to read foreign (untrusted) cookies in a trusted network?)

I'm still unsure how it works and if each browser needs to install a certificate but it sounds like a proxy on your lan connection either redirects the domain (i probably misunderstood) or uses an alternative certificate (doesn't the cert need to match the domain? i'm still confused).

Would it be possible to check if i am connected to the true site? It would be helpful too if you can explain how the proxy can create a valid cert for a domain it doesn't have the real cert/keys for. (I know its two questions but both can potentially be explain with one answer)