I have some specific security questions about the practice of switching between HTTPS and HTTP in single page apps.
First, after watching several videos, I was amazed at how quickly a smart hacker can insert a third party machine (MITM) between two parties, even with an SSL signed certificate.
Second, it was a little disheartening to see how Google was breached with an attack by some Iranian hackers with a forged certificate. Really tough to guard against this.
From what I now understand, if a site is started with an HTTP URL, it is susceptible to a MITM attack because the attacker can highjack the communication channel when it is not secure and thereafter they can work their mischief. Is my understanding correct?
The following is a Fiddler snapshot of two well know companies that start with HTTP and then tunnel to a secure site using HTTP.
...
Go to the complete details ...