undefined | Better HN

0 pointsGurrewe9y ago0 comments

Doesn't make it better tough, a MITM could change the action URL of the form.

0 comments

MITM requires a man in the middle. For the most part, a state level adversary is required for a generalized MITM attack.

megabytemike9y ago

Come join my wifi network at the coffee shop :-D

jgalt2129y ago

Yes, but that's not a general MITM attack as the NSA has pulled off. Only the folks at that particular coffee shop are placed at risk from this particular adversary.

staticfish9y ago

not if it's pinned at the web app level.

tyre9y ago

Again, MITM.

If you mean the front-end web (JS) app, MITM the request from the server to the client browser and replace the hardcoded submission url in the JS.

staticfish9y ago

Not really. I used Play Framework which is also its own webserver. SSL is at both the app and webserver level.

j / k navigate · click thread line to collapse

0 comments

jgalt2129y ago

MITM requires a man in the middle. For the most part, a state level adversary is required for a generalized MITM attack.

megabytemike9y ago

Come join my wifi network at the coffee shop :-D

jgalt2129y ago

Yes, but that's not a general MITM attack as the NSA has pulled off. Only the folks at that particular coffee shop are placed at risk from this particular adversary.

staticfish9y ago

not if it's pinned at the web app level.

tyre9y ago

Again, MITM.

If you mean the front-end web (JS) app, MITM the request from the server to the client browser and replace the hardcoded submission url in the JS.

staticfish9y ago

Not really. I used Play Framework which is also its own webserver. SSL is at both the app and webserver level.

j / k navigate · click thread line to collapse