3 ms·
Does not seem like a big deal to me; because it's unlikely to work outside a lab environment, nor passed the first 256 bytes (without a truly massive amount of
by powertower 14y ago
Does not seem like a big deal to me; because it's unlikely to work outside a lab environment, nor passed the first 256 bytes (without a truly massive amount of connections at least).
And all that work for what - to sniff out your own cookie?
I mean, what is this good for, it's not a man-in-the-middle attack, it's not a spoofing attack, etc?
*Though it's really good work on the researchers part, and the author of the article explained it all in an excellent way.
- tptacek 14y agoNo, I think you've misunderstood this attack at multiple points. The attack gives the researchers the ability to use any HTML page on the Internet to trick your browser into launching an attack on your Paypal cookie. Once they have that cookie, they don't care about MITM attacks; they'll just impersonate you. The attack is very time-consuming, though, so you're right that it's not a particularly urgent real-world threat at the moment.
- powertower 14y agoYou're right, that's kind of what I got from it by reading the other thread after posting... You'd need to visit a page that exploits JS to make those connections to get that cookie. Afterwards, I guess it depends.