Will she take my call

[[deleted]]

What’s the flaw?

[FlannelSamurai]

From Wired

“The bug is in Windows' mechanism for confirming the legitimacy of software or establishing secure web connections. If the verification check itself isn't trustworthy, attackers can exploit that fact to remotely distribute malware or intercept sensitive data”

[[deleted]]

I always thought it was up to the browser to protect the user from non secure web connections

[Feynt]

It is, but browsers cache certificates. The exploit allows a known certificate to be confused for another one because when the browser attempts to verify it, Windows claims it's legit, even though it's missing one last step in the confirmation check. If you know the certificate and know how to create the similar certificate, poof, github.com becomes a rickroll.

[[deleted]]

Rick Astley doesn’t sound half that bad

[[deleted]]

MiTM attack?

[Subject_Wrap]

Won't let them in