I can't imagine any online store not being served over SSL in 2022
It happens. Someone's computer-proficient nephew gets asked to create a shop frontend for a family/hobby business, so they drop WooCommerce on a shared host and go live. What's SSL?
There are also the failures to redirect 80->443 or disable non-HTTPS access, so tools like SSLStrip can still pay off.
Also a problem I encountered in the wild, is that a potential attacker tries to trick a user into installing a malicious CA Public key as requirement to be allowed past the captive portal.
Unfortunately mitigating this is hard(er) and only mTLS could solve that issue.
Unfortunately, very valid point. Love the example btw :)
Browsers have been getting better at warning users. Which is actually a great help, I think. But no guarantee at all, especially for less tech-savvy users.
Comments
It happens. Someone's computer-proficient nephew gets asked to create a shop frontend for a family/hobby business, so they drop WooCommerce on a shared host and go live. What's SSL?
There are also the failures to redirect 80->443 or disable non-HTTPS access, so tools like SSLStrip can still pay off.
This is so true in practice ;-)
Also a problem I encountered in the wild, is that a potential attacker tries to trick a user into installing a malicious CA Public key as requirement to be allowed past the captive portal.
Unfortunately mitigating this is hard(er) and only mTLS could solve that issue.
Unfortunately, very valid point. Love the example btw :)
Browsers have been getting better at warning users. Which is actually a great help, I think. But no guarantee at all, especially for less tech-savvy users.