You use webmitm[1] or ettercap[2] to get the traffic. Sure users will get a cert warning, but you are going to at least catch a few people that click through it.
Well done, sir. Even so, I think once a user is shown a cert warning it becomes their problem, not the site owner's(in the sense of who's responsible that is). When it comes to security, everyone has their part to play.
Comments
You use webmitm[1] or ettercap[2] to get the traffic. Sure users will get a cert warning, but you are going to at least catch a few people that click through it.
[1] http://manned.org/webmitm/8187425a
[2] http://samiux.blogspot.com/2011/05/howto-sniffing-ssl-with-e...
Amusingly the general classes of "users who leave default passwords" and "users who click through a warning" are going to have a big intersection.
Well done, sir. Even so, I think once a user is shown a cert warning it becomes their problem, not the site owner's(in the sense of who's responsible that is). When it comes to security, everyone has their part to play.