Talking about HTTPS security

Have you ever had the experience of using a smartphone app to shop in a Web store, or are you worried about not being safe enough? Some people will say rest assured that the shopping site has the use of SSL/TLS encrypted transmission, we come to talk about https OK.

The client and server side of the hand-over process is this, client issued a request, and the server after receiving the request, will be its own information to the certificate (including the issuing authority, the main body, the public key ...) . At this point the client will verify the legality of the certificate, if trusted, in the browser as an example, you can see a lock in the URL column, otherwise there will be a warning sign of the OH ~

If the certificate is valid (or illegal but the user chooses to continue), the client generates a random set of passwords and encrypts the information to the server using the public key in the certificate. The server decrypts the password with the private key after it receives the client transfer information. Decrypt the handshake information sent by the client with a password. The server again sends the hold information, the client decrypts and verifies whether the consistency, the handshake process ends. The subsequent data transfer is transmitted in symmetric encryption with a random password generated by the previous client. Because of the large amount of data, Symmetric encryption algorithms are more efficient.

HTTPS is a secure hand-held mechanism, attackers often only from the fake certificate, the use of SSL hostage way to attack. Previous vulnerabilities have been patched up almost.

The following is the use of Fiddler as a proxy server to observe the mobile phone login to a shopping site app packet content, login screen as shown below.

When the app is logged in, we'll be able to see the log in (the red box is the password) so that you/you are surprised?

But don't get me wrong, this way of setting up proxy server is not even a man-in-the-middle attack. Make a short distinction between you and me:

1. Proxy Agent-must be on the victim's mobile phone to modify the network settings, point to a proxy server, at this time the workstation as proxy server can naturally "see" to. It's like I'm asking you to go through my designated channel only, so you/I will not be able to hide from the security mechanism I have prepared.
2. Man-in-the-middle attack-must be in the case of the victim is not aware of the situation, it is said to be an attack, the total can not you/you want to beat others, but also with each other to borrow mobile phone to set proxy Bar ~ The following opportunities for you to explain in detail how to attack it ~

Talking about HTTPS security