I recently tested MITM on my LAN through SSLStrip, but I noticed that on Gmail and Fb doesn't work, while on other sites I can sniff connections easily. What is the difference?

  • @SteffenUllrich dang, a dupe. Could have thought so:/ – Tobi Nary Apr 6 '16 at 14:09

Those sites (and some more) use public key pinning with HSTS, whereas the browser does not accept other certificates or a downgrade to http.

| improve this answer | |
  • 1
    Milliseconds. You beat me by milliseconds. – WorseDoughnut Apr 6 '16 at 14:04
  • I don't understand what is the use of the public key pinning and the reason why it would avoid the SSLstrip. – HenryC Apr 6 '16 at 21:17

Not the answer you're looking for? Browse other questions tagged or ask your own question.