8 ms·

wait, myetherwallet doesn't use HSTS? I thought they had a vulnerability analysis done a few months ago. I feel like this should have been something that was ca

• Cshelton 8y ago
  Wow, that's scary. I even told someone recently, jokingly of course, they forgot to add HSTS for their mvp app. But MEW doesn't have HSTS? I would never use it personally on a public Wifi, but many people will for sure and they have no idea they'd be MITM'd.
  • tekstar 8y ago
    > But MEW doesn't have HSTS? I would never use it personally on a public Wifi, but many people will for sure and they have no idea they'd be MITM'd. Even without HSTS a bad actor would have to either trick a user to install a root cert or trick a certificate authority to generate a cert for the domain. Both of these are possible and have happened in the past, but they're also are a requirement for the attack you mention that you seemed to have completely forgotten about.
    • C4K3 8y ago
      No they wouldn't, without HSTS a bad actor (public wifi) could just do an SSL strip attack. Sure, observant users would notice that the page isn't over https, and with browsers adding warnings on all http pages, that'll become more obvious, but it's still not something most people notice. Are you thinking of HPKP?
      • tekstar 8y ago
        ah, yes, I was confusing HSTS with HPKP. Now I need to re-read the whole thread with this context. Thanks for the correction!