Which is why everyone needs to learn about HSTS (my new favorite thing). There's room for a stripping attack upon first connecting and being redirected from http to https but from then on you've mitigated most of the problem.
You use webmitm[1] or ettercap[2] to get the traffic. Sure users will get a cert warning, but you are going to at least catch a few people that click through it.
Well done, sir. Even so, I think once a user is shown a cert warning it becomes their problem, not the site owner's(in the sense of who's responsible that is). When it comes to security, everyone has their part to play.
Comments
Which is why everyone needs to learn about HSTS (my new favorite thing). There's room for a stripping attack upon first connecting and being redirected from http to https but from then on you've mitigated most of the problem.
You use webmitm[1] or ettercap[2] to get the traffic. Sure users will get a cert warning, but you are going to at least catch a few people that click through it.
[1] http://manned.org/webmitm/8187425a
[2] http://samiux.blogspot.com/2011/05/howto-sniffing-ssl-with-e...
Amusingly the general classes of "users who leave default passwords" and "users who click through a warning" are going to have a big intersection.
Well done, sir. Even so, I think once a user is shown a cert warning it becomes their problem, not the site owner's(in the sense of who's responsible that is). When it comes to security, everyone has their part to play.