17 lines
824 B
Plaintext
17 lines
824 B
Plaintext
|
=== What is the potential impact?
|
||
|
|
|
||
|
|
Establishing trust in a secure way is a non-trivial task. When you disable
|
||
|
|
hostname validation, you are removing a key mechanism designed to build this
|
||
|
|
trust in internet communication, opening your system up to a number of
|
||
|
|
potential threats.
|
||
|
|
|
||
|
|
==== Identity spoofing
|
||
|
|
|
||
|
|
If a system does not validate hostnames, it cannot confirm the identity of
|
||
|
|
the other party involved in the communication. An attacker can exploit this by
|
||
|
|
creating a fake server and masquerading it as a legitimate one. For example,
|
||
|
|
they might set up a server that looks like your bank's server, tricking your
|
||
|
|
system into thinking it is communicating with the bank. This scenario, called
|
||
|
|
identity spoofing, allows the attacker to collect any data your system sends
|
||
|
|
to them, potentially leading to significant data breaches.
|