HTTPS Is Not Enough
summary
Shows how an attacker on a local network uses a Raspberry Pi hotspot with iptables and a small node.js proxy to perform HTTPS stripping and inject JavaScript, demonstrating live compromises of NatWest and Banco Popolare logins; also notes off‑the‑shelf gear like a Wi‑Fi Pineapple makes this trivial. Recommends automated certs (Let’s Encrypt), CSP’s upgrade-insecure-requests, HSTS with preload; cites that ~70% of top million sites still support HTTP while only 4% use HSTS, so many sites remain vulnerable.
AI-written summary · about
chapters (7)
- 0:00Start
- 4:04is pretty hard
- 6:00ARP Spoofing
- 9:52Not Enough
- 25:59Let's Encrypt
- 29:42HTTP STRICT TRANSPORT SECURITY
- 31:36What about the first request?
