-1

Why do “Unsecure connection” warnings in modern browsers don’t work against SSL Strip?

Reza
  • 7
  • 1

1 Answers1

1

You should watch Moxie Marlinspike's talk Defeating SSL using SSLStrip. In short SSLStrip is a type of MITM attack that forces a victim's browser into communicating with an adversary in plain-text over HTTP, and the adversary proxies the modified content from an HTTPS server. To do this, SSLStrip is "stripping" https:// URLs and turning them into http:// URLs.

HSTS is a proposed solution to this problem.

Answer From How does SSLstrip work?

Community
  • 1
overshadow
  • 361
  • 3
  • 5
  • 18