Timeline for Options when defending against SSLstrip?
Current License: CC BY-SA 2.5
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 29, 2015 at 6:27 | review | Suggested edits | |||
| May 29, 2015 at 7:46 | |||||
| Jun 27, 2012 at 11:08 | comment | added | curiousguy | "You're totally missing the point." So: 1) I initially totally missed the point 2) Now I think I am getting 3) I stand by the fact that your answer is not clear as worded, and is difficult to understand without the comments 4) If you could rephrase your answer making clear this is about a proxy, I would remove the downvote. | |
| Jun 27, 2012 at 9:17 | comment | added | curiousguy | "I'm not saying from the server hosting side e.g. mydomain.com." Yet, your answer says "server" twice. Do you know you can edit your message in order to clarify it? "I'm convinced at this point you're intentionally just being difficult." how much would you bet? Do a poll: ask people if your answer is clear. | |
| Jun 27, 2012 at 8:55 | comment | added | RobotHumans | You're totally missing the point. I'm not saying from the server hosting side e.g. mydomain.com. I'm saying from a local proxy for a LAN before ever leaving. I'm convinced at this point you're intentionally just being difficult. | |
| Jun 27, 2012 at 2:53 | comment | added | curiousguy | "Hence it is useful." Sorry, it is not. It makes zero difference. You might as well not have an HTTP site at all. | |
| Jun 26, 2012 at 19:28 | comment | added | RobotHumans | It would prevent a mitm-ed user from fetching non-http assets. Instead of a "Paypal" banner it would display "you have been hijacked". Hence, they don't continue entering data. Hence it is useful. | |
| Jun 26, 2012 at 19:22 | comment | added | curiousguy | "If someone tries gets any assets via http, you replace all assets with "you have been hijacked."" So you end-up with an http website that just says "you have been hijacked."? Why do you even have an http website then? why note https only? "I thought that was relatively clear from the statement." It isn't clear how this blocking might be useful in any way! | |
| Jun 26, 2012 at 16:47 | comment | added | RobotHumans | @curiousguy Forcing https at the proxy as stated in the question(we're talking local proxy in a business case). If someone tries gets any assets via http, you replace all assets with "you have been hijacked." I thought that was relatively clear from the statement. | |
| Jun 26, 2012 at 4:34 | comment | added | curiousguy | "From the server side" how could you know the client is being MITM-ed? | |
| Feb 13, 2011 at 20:10 | history | answered | RobotHumans | CC BY-SA 2.5 |