4 ms·
If the inner browser has its own client certificate or simply checks for a set of known server certificates, MITM won't get you anywhere. Done right, this could
by gmueckl 7y ago
If the inner browser has its own client certificate or simply checks for a set of known server certificates, MITM won't get you anywhere. Done right, this could well be game over.
- int_19h 7y agoFor it to be truly game over, the wasm implementation it's running on must also protect the wasm payload itself, otherwise it would be trivial to patch that to MITM it. So, on something like iOS, it could be game over (but I'm also curious what Apple is going to do with wasm there, given that it goes contrary to their strategy of being the gatekeeper for all code running on the platform). But not for the rest.
- gmueckl 7y agoAdding a ton of obfuscation will do the trick. Patching wasm requires reverse engineering and that is very cumbersome. For Blu-Ray it took months to reverse engineer the copy protection VM and that was with a mechanism that took a lot of attention. If it's your average website, it's far easier to stay ahead of the game.