10

The Secure Remote Password (SRP) protocol can be used to send credentials over an unencrypted network. You could also require SSL/TLS client authentication which will prevent the proxy from being able to establish a connection to the web server.


2

First of all: What sslstrip does is it replaces https-links with non-https-links on hijacked non-https- websites. E.g. when the victim visits a http-only search engine via an insecure public wifi, the attacker can use sslstrip to replace https-links in the search engine- results with http-only links. I guess that the websites you are targeting (e.g. ...


1

See https://help.github.com/en/github/authenticating-to-github/testing-your-ssh-connection for the expected host fingerprint. I used ssh -v -T git@github.com to see the host key my ssh client verified, and it was nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8 which is listed on their page, so the connection is not MiTM'd. I don't know why it happened. I guess ...


1

If attacker gets access to a private key material of the server certificate, your security is compromised. What you can do is to add security to key storage and store the key in HSM (Hardware Security Module).


1

It is perfectly fine to use a cryptographic hash ("fingerprint") of the certificate for comparison instead of the certificate itself. And this is actually often done when implementing certificate pinning. A man in the middle would not be able to generate a certificate and matching private key where the certificate has exactly the same fingerprint as your ...


1

This answer is inspired by my conversation with MechMK1 in the comments. The problem that MechMK1 points out in the comments basically boils down to authenticity, which is often seen as the achilles heel of public key cryptography. How can you be sure the public key purporting to belong to the person that you are attempting to connect with really belongs ...


Only top voted, non community-wiki answers of a minimum length are eligible