3 ms·
Quantum insert is actually rather simpler than that attack. Watch for GET request, passively, then inject a response, racing the web server. The real response a
by tedunangst 4y ago
Quantum insert is actually rather simpler than that attack. Watch for GET request, passively, then inject a response, racing the web server. The real response arrives a millisecond late and gets dropped as duplicate. No need to desync streams.
- pixl97 4y agoOnly if your still running http without the s, right?
- tptacek 4y agoYes.
- Nullabillity 4y agoIf you care then you're already running TLS anyway, and they'd only be able to inject garbage. If you don't run TLS then it's already game over anyway.