Hacker News new | ask | show | jobs
by click170 4217 days ago
Its possible to MITM an HTTPS connection, trick you into thinking it is secure by providing a green lock favicon, and intercepting or sniffing everything you do over that connection. And it will work on nearly every website in existance.

More people should be aware of SSL Strip and how to protect yourself against it.

http://www.thoughtcrime.org/software/sslstrip/
1 comments
bzbarsky 4217 days ago
> Its possible to MITM an HTTPS connection

Not in the case of Firefox connecting to AMO, because it uses a pinned certificate for that.

link
click170 4215 days ago
Are you sure?

I perform HTTPS interception on all out-bound traffic on my network and I don't recall making an exception for AMO, and I have a number of add-ons installed. Though, it wouldn't be the first time I've forgotten about something like that.

link
bzbarsky 4209 days ago
Did you install your addons before updating to Firefox 32? That's when the pinning was introduced.
link