Take the 2-minute tour ×  Alice wants to login to her account at
https://www.bobsbank.com/. However she clicks on a malicious
link in an email and instead gets sent to the malicious site
https://www.charliesbank.com/. The malicious site has a secure
SSL relationship with Alice. Alice sees the "this site is
secure" padlock icon in her browser. When the malicious site
(Charlie's Bank) receives Alice's request, the malicious site
decrypts the request using the SSL certificate which it owns. It
then re-encrypts the request with the public key for Bob's Bank.
It has established an SSL relationship with Bob's Bank. Bob's
Bank has no way of knowing that Charlie is not, in fact, Alice,
as Charlie can provide all of Alice's information. Charlie can
then listen in on, and even tamper with, Alice's subsequent
browsing session.  Does this attack work and is there any way to
prevent against it?  share|improve this question add comment  5
Answers  up vote 4 down vote accepted  This is exactly why I got
so pissed off at Ban