5 ms·
If Baidu served everything over https, would that effectively make this attack impossible unless the China GFW mitm'd the connections? I suppose that might add
by rufugee 12y ago
If Baidu served everything over https, would that effectively make this attack impossible unless the China GFW mitm'd the connections? I suppose that might add a significant server load to Baidu, but I wonder if we should just start accepting SSL as a cost of doing business on the internet.
Of course, that would require Baidu's cooperation, and I suppose they might now want to raise the ire of the Chinese government. Also, I suppose the government could just use their own heavily trafficked sites to do this, but that should isolate it somewhat to Chinese IP ranges.
- MikeTV 12y agoSince the requests for hm.js are taking place over HTTP, even if Baidu started responding with 301's to reconnect over SSL wouldn't the GFW be able to just intercept the initial insecure request and respond with its own version of hm.js?
- akfanta 12y ago> that would require Baidu's cooperation Don't count on that. Baidu is part of the Chinese government gang. It is notorious for censoring/altering search results both for political and commercial reasons. I wouldn't be surprised if they were notified about this beforehand.
- rifung 12y agoI don't think they would be able to MITM the connections because your browser would detect that they don't own the certificate for the site. Unless of course, the CA is also compromised. I'm no expert so please do correct me if I'm wrong =]