X-Git-Url: https://ruderich.org/simon/gitweb/?p=tlsproxy%2Ftlsproxy.git;a=blobdiff_plain;f=README;fp=README;h=1e1efa7f76e8c90808fc5f1a6d419da3f806d88d;hp=b0124c1279b961ebf6bdf064ff8f28ee3780296d;hb=061aa8165e1d74ab90b1fe3b07870536779a67ce;hpb=b8d21b82454395cb5c5e8473223a10175b23ea51

diff --git a/README b/README
index b0124c1..1e1efa7 100644
--- a/README
+++ b/README
@@ -91,6 +91,11 @@ If you always verify the authentication of the connection this isn't a
 problem, but if you only check if it's a HTTPS connection then this attack is
 possible.
 
+Another issue is embedded active content, like JavaScript. If the website
+includes data from a different host (e.g. a different sub-domain), for which
+tlsproxy has no certificate, then an attacker can MITM that connection and
+inject JavaScript with unknown consequences into the browser.
+
 
 KNOWN ISSUES
 ------------