3. HSTS Bob runs a website at APlusWebDev.com, and his server uses HTTPS and HSTS. (a) Bob's CA-signed certificate expires, and he decides to go back to using a self-signed certificate, but his browser won't let him bypass the certificate warning. What's the problem? What should Bob do? (b) Mallory has compromised the router that connects Bob's server to the Internet. Explain how she can replace the content of Bob's site any time a new customer visits it. What additional security measure should Bob take to prevent this attack? (c) Bob wants to spice up his website! For each of the following things he might do, ex- plain whether it is dangerous and, if so, give an example of how an attacker might exploit it to attack Bob's users. Also indicate which of these items will trigger a mixed- content indicator in users' browsers. i. Linking to a file to download from an HTTP site. ii. Including an image hosted at an HTTP site. iii. Including a stylesheet hosted at an HTTP site iv. Including JavaScript hosted at an HTTP site. 3. HSTS Bob runs a website at APlusWebDev.com, and his server uses HTTPS and HSTS. (a) Bob's CA-signed certificate expires, and he decides to go back to using a self-signed certificate, but his browser won't let him bypass the certificate warning. What's the problem? What should Bob do? (b) Mallory has compromised the router that connects Bob's server to the Internet. Explain how she can replace the content of Bob's site any time a new customer visits it. What additional security measure should Bob take to prevent this attack? (c) Bob wants to spice up his website! For each of the following things he might do, ex- plain whether it is dangerous and, if so, give an example of how an attacker might exploit it to attack Bob's users. Also indicate which of these items will trigger a mixed- content indicator in users' browsers. i. Linking to a file to download from an HTTP site. ii. Including an image hosted at an HTTP site. iii. Including a stylesheet hosted at an HTTP site iv. Including JavaScript hosted at an HTTP site