1

I recently tested MITM on my LAN through SSLStrip, but I noticed that on Gmail and Fb doesn't work, while on other sites I can sniff connections easily. What is the difference?

1
  • @SteffenUllrich dang, a dupe. Could have thought so:/
    – Tobi Nary
    Apr 6, 2016 at 14:09

1 Answer 1

4

Those sites (and some more) use public key pinning with HSTS, whereas the browser does not accept other certificates or a downgrade to http.

2
  • 1
    Milliseconds. You beat me by milliseconds. Apr 6, 2016 at 14:04
  • I don't understand what is the use of the public key pinning and the reason why it would avoid the SSLstrip.
    – HenryC
    Apr 6, 2016 at 21:17

Not the answer you're looking for? Browse other questions tagged .