4 ms·
You are assuming, that all packages are equally interesting (and your math does not account for package dependencies). In practice, attacker either does not ca
by yc12340 8y ago
You are assuming, that all packages are equally interesting (and your math does not account for package dependencies).
In practice, attacker either does not care about your packages, in which case hiding that information gains you nothing, or wants to be alerted, when you (or anybody else) install one of few specific packages. Those combinations can be computed in advance and identified in traffic.
- zaarn 8y agoNot necessarily, I think you underestimate the complexity of this attack. Even if you were interested in a few packages, if any additional packages are mixed in or if dependencies are already installed, this problems become a lot harder again. While HTTPS doesn't make such an "attack" impossible, it makes it very hard and compared to HTTP the attacker cannot inject or replace data (replay attacks are possible with APT on plain HTTP)