4 ms·
I think there's a few flaws with your process: 1: I'm pretty sure browsers keep a local list of known malicious hashes, and only request a list if the URL matc
by thenewnewguy 7y ago
I think there's a few flaws with your process:
1: I'm pretty sure browsers keep a local list of known malicious hashes, and only request a list if the URL matches it. So those 13-14 URLs would all have to happen to have a prefix on the safe browsing list (presumably quite unlikely). I guess tencent could just advertise every hash as being on the list, but I feel like that would've been discovered if that was the case.
2: Even with 13-14 hashes I don't think that _guarantees_ a match, it's just the average you'd expect to need in order to find a match.
3: This becomes significantly harder when a user browses multiple websites at a time (which most people do, even if its just because they click a link from one website to go to another).
- bigiain 7y ago1)N Yeah - this assumes the safe browsing list is under control of the attacker. They could ensure that https://free-hk.org/ https://free-hk.org/ and https://free-hk.org/about https://free-hk.org/about and https://free-hk.org/blog https://free-hk.org/blog and https://free-hk.org/news https://free-hk.org/news and https://free-hk.org/donate https://free-hk.org/donate and https://free-hk.org/next-protest https://free-hk.org/next-protest are all "on the list". 2) Right. I was imagining some sort of binary search through the hash space - which might be way off base. It might actually take all 10,000 pages to guarantee it? That seems wronger in my head than binary search? 3) I don't think that matters so much, the order or sequences don't matter, only a cluster of visits within a chosen timeframe. I don't mind if you browse to https://bank.tld/ https://bank.tld/ in between https://free-hk.org/news https://free-hk.org/news and https://free-hk.org/next-protest.. https://free-hk.org/next-protest...