• Catsrules
    link
    fedilink
    arrow-up
    1
    arrow-down
    1
    ·
    1 year ago

    How would they do man in the middle attacks? Don’t you need to trust their certificate first?

    • Da_Boom@iusearchlinux.fyi
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      That mechanism only happens after you connect to it, you have to connect to the wifi in order to download the certificate to connect. And it doesn’t apply to all open WI-FI. A someone can still spoof the wifi. The fun part is when they set up their own false “I agree to the usage” pop up page that just steals your data - standardised systems like this are easily spoofed, especially when it comes to open and insecure wifi. They could even send you a bogus certificate that routes all the traffic through their gateway, allowing them to spy on the secure connections.