I recently did an experiment using MitM to gain account information (username and password) while accessing websites. I used two PCs in the scenario; one as the target, running Internet Explorer, and one as the attacker, running ettercap. One attempt (pretending to be steamcommunity.com) yielded information; the target accepted the attacker's fake CA self-signed certificate presented via the MitM attack. The other attempt (pretending to be facebook.com) didn't even allow me to add an exception for the self-signed certificate on the target machine. So the question is, why did one website allow me to add an exception while the other one didn't?
The short answer is HTTP Strict Transport Security .
When a web application issues HSTS Policy to user agents, conformant user agents behave as follows:
- Automatically turn any insecure links referencing the web application into secure links. (For instance, http://example.com/some/page/ will be modified to https://example.com/some/page/ before accessing the server.)
- If the security of the connection cannot be ensured (e.g. the server's TLS certificate is not trusted), show an error message and do not allow the user to access the web application.
On websites that have it configured, many browsers will not let you add an exception for untrusted certificates.