X-Git-Url: https://ruderich.org/simon/gitweb/?a=blobdiff_plain;f=README;h=1e1efa7f76e8c90808fc5f1a6d419da3f806d88d;hb=93c48dd90c3ae976b997b3a776a3775167b42369;hp=31d64f9f8e022fe6e538bc846f15dcc246d20023;hpb=2c6f390decf78aeddfd8d652e32343e7b11f0f06;p=tlsproxy%2Ftlsproxy.git

diff --git a/README b/README
index 31d64f9..1e1efa7 100644
--- a/README
+++ b/README
@@ -24,6 +24,7 @@ This creates the following files:
 
 - `proxy-ca.pem`:      CA which is used for all connections to the client
 - `proxy-ca-key.pem`:  private key for the CA
+- `proxy-dh.pem`:      Diffie-Hellman parameters for the proxy
 - `proxy-key.pem`:     private key for the proxy
 - `proxy-invalid.pem`: special certificate used for invalid pages
 
@@ -90,6 +91,11 @@ If you always verify the authentication of the connection this isn't a
 problem, but if you only check if it's a HTTPS connection then this attack is
 possible.
 
+Another issue is embedded active content, like JavaScript. If the website
+includes data from a different host (e.g. a different sub-domain), for which
+tlsproxy has no certificate, then an attacker can MITM that connection and
+inject JavaScript with unknown consequences into the browser.
+
 
 KNOWN ISSUES
 ------------