Security protocol observations

[adam.williams]

@stampycode

lol, I think you’ve missed how MITM works here - the client will make a request to connect to https://api.monzo.com - that’s all groovy. The problem is when a MITM attack injects packets into the connection during the DNS resolution request and the SSL/TLS handshake, downgrading the request to a HTTP one (it’s a bit more complex than that, but you get the idea) and redirecting the website traffic to an endpoint of the hacker’s choice.

No, I don’t get the idea.

If the URL is HTTPS, the client will connect on port 403 and negotiate a secure connection. There’s nothing you can do with DNS that will downgrade it.

Can you provide a link to the paper describing the attack you’re talking about so I can understand exactly what you’re suggesting?

Here’s the slide describing sslstrip from Blackhat '09:

Note it’s just rewriting URLs that are referenced from a site served in plaintext. There’s no way it’d be able to rewrite URLs in a client application that were hardcoded to use https://api.monzo.com.