X-Git-Url: https://ruderich.org/simon/gitweb/?a=blobdiff_plain;f=README;h=f72eca02910eb361426f9d2af293471039ac497e;hb=7eba49d24d56288d83746f3f0ce383d7c0c36552;hp=b0124c1279b961ebf6bdf064ff8f28ee3780296d;hpb=219d904b7d12173ee93d016fe1a2cb8ae32eea9c;p=tlsproxy%2Ftlsproxy.git

diff --git a/README b/README
index b0124c1..f72eca0 100644
--- a/README
+++ b/README
@@ -91,6 +91,11 @@ If you always verify the authentication of the connection this isn't a
 problem, but if you only check if it's a HTTPS connection then this attack is
 possible.
 
+Another issue is embedded active content, like JavaScript. If the website
+includes data from a different host (e.g. a different sub-domain), for which
+tlsproxy has no certificate, then an attacker can MITM that connection and
+inject JavaScript with unknown consequences into the browser.
+
 
 KNOWN ISSUES
 ------------
@@ -111,7 +116,7 @@ LICENSE
 
 tlsproxy is licensed under GPL version 3 or later.
 
-Copyright (C) 2011-2013  Simon Ruderich
+Copyright (C) 2011-2014  Simon Ruderich
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by