5 ms·
Google has HSTS so requests will be prematurely terminated, however it'll still be a huge DDoS attack.
by HappyTypist 11y ago
Google has HSTS so requests will be prematurely terminated, however it'll still be a huge DDoS attack.
- 0x0 11y agoWell if you control the domain you can easily get an SSL cert (except some clients might pin the CA for google.com).
- nly 11y agoIIRC, all Chrome users are pinned for *.google.com
- LgWoodenBadger 11y agoHowever, chrome will still trust certs issued for Google domains that come from non-Google trusted issuers (things in your local trusted keystore) It sucks because now your employee can MITM you for gmail/google chat/etc
- HappyTypist 11y agoCertificates are pinned too.