8 ms·
> Although terminating the encryption was necessary to inspect the traffic and effectively mitigate the attack, the use of HTTP Pipelining required Google to co
by blibble 4y ago
> Although terminating the encryption was necessary to inspect the traffic and effectively mitigate the attack, the use of HTTP Pipelining required Google to complete relatively few TLS handshakes.
surprised they put that in there... now the attackers know what to do next time
- testplzignore 4y agoThough the cost is symmetric, right? The attacker would have to incur some computational cost for the handshake.
- blibble 4y agofor RSA signing is more expensive than verifying for EC algos it's the opposite
- wbl 4y agoThe attacker can replay the key material multiple times or use RSA modes where the server does a lot of work.
- advisedwang 4y agoI mean it's rare that the attacker is paying for the resources in large DDoS. Usually it's bot-nets and the like to the cost is paid by the owner of the owned machines.
- danpalmer 4y agoIn a way, but another way of looking at it is that on the same pool of resources the botnet wouldn’t be able to achieve the same request rate if they expended these extra resources.