4 ms·
I'm still unclear on a couple of things. How do you even know which send request the attacker attempted to attack if only the codeword identifies the send reque
by 0x0 9y ago
I'm still unclear on a couple of things. How do you even know which send request the attacker attempted to attack if only the codeword identifies the send request, and the codeword was wrong? Also, what stops an attacker from trying again - alternatively, what stops an attacker from doing a denial-of-service by purposefully guessing the wrong codeword?
- meejah 9y agoThe codes have a small number in front; these are the requests. So if the server did allow 65k requests, each one would be a different number. You can guess once per request. Yes, an attacker can denial-of-service by guessing once on all the (possible) requests. There is some work towards stopping this sort of behavior (see e.g. https://github.com/warner/magic-wormhole/issues/126 https://github.com/warner/magic-wormhole/issues/126)
- 0x0 9y agoThanks for the explanation!