IssueRaiser

With all due respect, how is that worse than HTTP?

With all due respect, how is that worse than HTTP? Plain HTTP can be MITMed just as well, only that on HTTP - except that no one would do that because for HTTP, plain old packet sniffing is enough to eavesdrop on a connection. Which doesn't work for self-signed HTTPS connections. And there are in fact a lot of common scenarios where it is easy for an attacker to sniff packets but harder to establish an MITM.

Posted by xg15 on Apr 9, 2015, 2:01 PM

Tags

Related issues

Raise real-world problems, find people facing the same issue, and discuss solutions.7,000 issues0 comments

hackernews (Other)

With all due respect, how is that worse than HTTP?

xg15Apr 9, 2015, 2:01 PM

With all due respect, how is that worse than HTTP? Plain HTTP can be MITMed just as well, only that on HTTP - except that no one would do that because for HTTP, plain old packet sniffing is enough to eavesdrop on a connection. Which doesn't work for self-signed HTTPS connections. And there are in fact a lot of common scenarios where it is easy for an attacker to sniff packets but harder to establish an MITM.

Comments (0)

No comments yet. Start the discussion.

Comment on this issue