4 ms·
That wouldn't work over SSL, as there is no plain text in the HTTP Verb. And I recall a "paper" coming up some months ago that was mentioning the protocols the
by uxp 16y ago
That wouldn't work over SSL, as there is no plain text in the HTTP Verb. And I recall a "paper" coming up some months ago that was mentioning the protocols the PS3 goes through, which does confirm that the data is transmitted over SSL.[0]
[0] http://arstechnica.com/gaming/news/2011/02/report-psn-hacked-showing-stunning-lack-of-credit-card-security.ars http://arstechnica.com/gaming/news/2011/02/report-psn-hacked...
- marshray 16y agoThe SSL gets decrypted inside the web server process memory, at the latest. Sometimes it's stripped off by an SSL offload accelerator device before even entering the web server. The numbers probably also cross the wire in plain text between the web server and the database too.
- rhizome 16y agoAnecdotal, but I'd say stripping SSL at the border is much more common that leaving it intact to the node.
- holdenk 16y agoIf the attacker "0wned" the servers the fact there was encryption between you and the server doesn't really help a whole lot, they can just insert them selves in the stack post encryption (or even use the private key to decrypt the encrypted traffic if they wanted to minimize the number of points they touched).