1

I recently tested MITM on my LAN through SSLStrip, but I noticed that on Gmail and Fb doesn't work, while on other sites I can sniff connections easily. What is the difference?

marked as duplicate by Steffen Ullrich, RoraΖ, schroeder Apr 6 '16 at 14:48

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • @SteffenUllrich dang, a dupe. Could have thought so:/ – Tobi Nary Apr 6 '16 at 14:09
5

Those sites (and some more) use public key pinning with HSTS, whereas the browser does not accept other certificates or a downgrade to http.

  • 1
    Milliseconds. You beat me by milliseconds. – WorseDoughnut Apr 6 '16 at 14:04
  • I don't understand what is the use of the public key pinning and the reason why it would avoid the SSLstrip. – HenryC Apr 6 '16 at 21:17

Not the answer you're looking for? Browse other questions tagged or ask your own question.