3 ms·

I think I'm missing something. Why wouldn't this attack work on, for example: bit1.com, bit2.com, bit3.com, etc.?

• draw_down 9y ago
  Hmm?
• CydeWeys 9y ago
  My interpretation was that it can only be set either on the exact hostname that was loaded, or on the second level domain name that was loaded. To set it on 32 different SLDs you'd have to redirect through 32 different domains, which the user would notice. Note that this is for the page that was loaded only, not for additional resources hosted on other hostnames.
  • deleted 9y ago
    [deleted]
  • Karliss 9y ago
    Redirecting 32 times could be made less obvious by opening a small popup which closes after finishing it's work. It used to be possible to open a popup in background, that would have made it almost practical.
    • JetSpiegel 9y ago
      Or just an async script?
      • deleted 9y ago
        [deleted]
• netheril96 9y ago
  Maybe because that is a little bit more expensive.
  • moviuro 9y ago
    $32 instead of $1. OK.