Why do “Unsecure connection” warnings in modern browsers don’t work against SSL Strip?


1 Answer 1


You should watch Moxie Marlinspike's talk Defeating SSL using SSLStrip. In short SSLStrip is a type of MITM attack that forces a victim's browser into communicating with an adversary in plain-text over HTTP, and the adversary proxies the modified content from an HTTPS server. To do this, SSLStrip is "stripping" https:// URLs and turning them into http:// URLs.

HSTS is a proposed solution to this problem.

Answer From How does SSLstrip work?


Not the answer you're looking for? Browse other questions tagged .