3 ms·
> one may manage to upload an html file to the bank's server and serve a -signed- page that google amp will cache Only if you have the bank's private key, and
by Ajedi32 7y ago
> one may manage to upload an html file to the bank's server and serve a -signed- page that google amp will cache
Only if you have the bank's private key, and the ability to serve arbitrary content from the bank's domain. In which case... yeah, I don't see how the signed exchanges standard makes that problem significantly worse.
- buboard 7y agoi don't know what's the max expiration for amp's cache, but i could set a really-long expiration date on the file and remove it from the server without the bank ever knowing it existed. SGX don't even require an upload - one disgruntled employee could do the same with a stolen key. Nobody benefits from this shit than google. Do we really need more attack surfaces?