4 ms·
This has gotten a bit better since then with HSTS (and I didn't understand whether the attacker was doing SSL stripping, but it's also gotten a lot better again
by schoen 9y ago
This has gotten a bit better since then with HSTS (and I didn't understand whether the attacker was doing SSL stripping, but it's also gotten a lot better against a passive attacker with much greater HTTPS adoption). But a significant fraction of these attacks would certainly still reveal sensitive information.
- samat 9y agoHow so?
- jandrese 9y agoSome of the stuff in the article seemed a bit magical. He could tell that someone bookmarked a website?
- neil_s 9y agoHe could tell that they submitted the website to Delicious, which would be an HTTP(S?) request, not a bookmark to their own browser.
- TJSomething 9y agoI'd assume by looking for a favicon request without any other requests.
- doctoboggan 9y agoHe could tell she was browsing https://del.icio.us/ https://del.icio.us/ and was able to find her account and see what she "bookmarked" there.