So you’ve… compromised your own security. Grats?
Comment on What is stopping a scammer from HTTPS certificating a "nonsense.ReputableBank.com"
over_clox@lemmy.world 2 months agoI’ve been able to downgrade https sites to plain http sites, through a series of loopholes which I won’t go into.
Serinus@lemmy.world 2 months ago
over_clox@lemmy.world 2 months ago
My own security? Hah, that’s a joke right?
Everything on the Internet Archive can be accessed via simple http, even if the original archived site was https.
Serinus@lemmy.world 2 months ago
All that does is allow someone in the middle to potentially read your traffic. So what’s secret about the traffic between you and the Internet archive? If it’s only your login details, that seems like a you problem.
It wasn’t long ago that most of the internet was http only.
over_clox@lemmy.world 2 months ago
Who said I log into anything? I have terabytes of files archived, without any accounts anywhere. I’m not that stupid.
themoonisacheese@sh.itjust.works 2 months ago
That’s nice, be sure to tell us how it goes when HSTS is enabled
elvith@feddit.org 2 months ago
Checks own servers…
Yeah, I’d like to see that…
over_clox@lemmy.world 2 months ago
web.archive.org/web/…/7667184419.html
Anything on the archive can be accessed via simple http, regardless of whether the original site was https or not.
elvith@feddit.org 2 months ago
Yeah, but now you’re talking about communicating with web.archive.org and not nonesense.reputable-bank.com as in the original post. In this case you’re not even trying to hide the fact, that you aren’t affiliated with reputable-bank.com and were back to square one and you could also just use reputable-bank.com.some.malicious-phishing.website to host your page.
Btw: all modern browsers will warn you when you access a non-encrypted website - some immediately, some only when you try to enter data into a login form.