I recently did an experiment using MitM to gain account information (username and password) while accessing websites. I used two PCs in the scenario; one as the target, running Internet Explorer, and one as the attacker, running ettercap. One attempt (pretending to be steamcommunity.com) yielded information; the target accepted the attacker's fake CA self-signed certificate presented via the MitM attack. The other attempt (pretending to be facebook.com) didn't even allow me to add an exception for the self-signed certificate on the target machine. So the question is, why did one website allow me to add an exception while the other one didn't?
Facebook uses HSTS (with preload[*]) while steamcommunity.com doesn't.
HTTP Strict Transport Security is a HTTP header that has two effects:
- It forces all connections to the site over HTTPS (even if it was accidentally linked/bookmarked/typed as HTTP)
- It aborts if any HTTPS error or warning exists. This includes self-signed certificate warnings, which means that it is impossible to accept these certificates.
[*] preload means that the browser is aware of HSTS even before the first visit. Without preload, you could perform a man in the middle attack on the very first request to the site, even if HSTS exists.