5 ms·
> You better have an extremely low jitter connection! Like AWS. (Cite: http://dl.acm.org/citation.cfm?id=1653687. http://dl.acm.org/citation.cfm?id=1653687.)
by JoachimSchipper 14y ago
> You better have an extremely low jitter connection!
Like AWS. (Cite: http://dl.acm.org/citation.cfm?id=1653687. http://dl.acm.org/citation.cfm?id=1653687.)
- __alexs 14y agoI doubt youd even have to break SSL using that attack. Lots of people do SSL termination at the load balancer.
- Dylan16807 14y agoOkay, but people don't run web browsers on AWS.
- abadidea 14y agoexcept when they do! http://www.amazon.com/gp/help/customer/display.html/?nodeId=200775440 http://www.amazon.com/gp/help/customer/display.html/?nodeId=...
- Dylan16807 14y agoDoesn't do HTTPS, also I am skeptical of cross-site javascript shenanigans happening on the server-end of silk.
- JoachimSchipper 14y agoPeople do run HTTPS clients on AWS, though. Web APIs tend to [1] require exactly that. [1] Lala people never send sensitive data over plain HTTP I'M NOT HEARING YOU.
- Dylan16807 14y agoSure, they might use HTTPS, but how often do they load arbitrary pages with uncontrolled javascript?
- JoachimSchipper 14y agoPretty much never. How often do they make requests that are at least partially attacker-controlled, though? (Note that variants on https://www.someapi.com/...?username=foo https://www.someapi.com/...?username=foo contain attacker-controlled data...)