HTTPoison (actually, Hackney) comes with secure HTTPS defaults. Last time I checked other HTTP clients, including HTTPotion/iBrowse, will happily let you pass in an HTTPS URL and connect to the server without any verification of the server’s certificate chain or identity (hostname). Basically they obscure the communication to avoid eavesdropping, but they don’t protect against MitM attacks unless you explicitly pass in all the right TLS configuration options.
3 Likes
