I just checked on my phone right now, and if you browse to En, the default Android Chrome browser both does not show you the https [...]
The behavior is slightly different for http sites. In that case, it shows an alert sign in the URL bar. In my opinion, that’s actually a better way to do it than expecting users to notice the missing s . In this case it’s still easily overlooked and your other attacks stand, especially vandalizing the page just before you pull off the stunt.
The behavior is slightly different for
httpsites. In that case, it shows an alert sign in the URL bar. In my opinion, that’s actually a better way to do it than expecting users to notice the missings. In this case it’s still easily overlooked and your other attacks stand, especially vandalizing the page just before you pull off the stunt.