3 ms·
> How exactly is a browser supposed to get access to the ciphertext in the first place? MITM attacks are usually considered relatively easy to pull off. Run a
by gpm 3y ago
> How exactly is a browser supposed to get access to the ciphertext in the first place?
MITM attacks are usually considered relatively easy to pull off. Run a fake wifi-hotspot in an airport, use the "login portal" to get access to their browser, use the hotspot itself to get access to the cipher texts when they visit other https page (edit: I suppose those would be decrypted on the CPU... but when they use whatever odd program that thought decrypting messages to it on the GPU is a good idea).
- bastawhiz 3y agoThat assumes the encrypted content is transferred in plaintext (not over https). I think you'd be hard pressed to find a HTTPS client that decrypts on the GPU. And then of course, the thing being decrypted needs to be big enough for the process to take long enough for them to perform the attack, which means many gigabytes (terabytes?). And then you'd still need to send the data from the mitm server back to the browser for processing before you start measuring anything. It's obvious they accomplished something, but the scenario they set up simply isn't something that is practical in the real world
- freeone3000 3y agoDRM-encrypted streaming video, perhaps? Gigabytes of encrypted data that needs to be decrypted and displayed?
- bastawhiz 3y agoBut you've still got to shuttle that data to the browser and it has to be decrypted on the GPU. I think you'd be hard pressed to find that anywhere in the wild. Modern CPUs can decrypt AES with specialized instructions at a rate that's practically measured in GB/s. Especially for streaming video that doesn't need to decrypt the full stream at once (and where you're probably already using the GPU to, you know, render the video) why would you use the GPU for AES?