[FD] Browser Security Tool: HTTPS Only 2.1 (Major Release, Open Source, Python)

[David Leo <david.leo@xxxxxxxxxxxxx>]

When we browse the web, top threats are:
1. Remote code execution - everything is lost
2. Man in the middle - sniffing, and tampering
3. Phishing - simple, old, and still quite useful
4. Cross site scripting - data of the vulnerable domain is lost
5. CSRF - unauthorized action

So, what if the browser can only access HTTPS of whitelist domains? With HTTPS, 
"man in the middle" is fixed. And with the whitelist, other attacks become very 
difficult, some even become impossible(such as phishing). Phishing is a huge 
headache in this era, because URLs can be hidden in legitimate redirection(such 
as t.co).

That's why we made this simple tool(really simple - less than 200 lines of 
Python and JavaScript):
Project Home Page - https://www.httpsonly.net/
Source Code - https://github.com/httpsonly/httpsonly

Kind Regards,


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/