4 ms·
Well I don't disagree but on the other hand the article is focused on what it does to a client so I wasn't thinking it through the way you are. It also occurs
by smhenderson 11y ago
Well I don't disagree but on the other hand the article is focused on what it does to a client so I wasn't thinking it through the way you are.
It also occurs to me that given the ability to insert yourself between the client and the server has to open up a number of possible attack vectors that are more worth while than crashing the client. I get (I think) the point about if censorship is the goal this is a way to make clients stay away from a particular server but if you're in a position to MITM them why not just return 404's and be done with it?
Not trying to argue, :-) Just want to make sure I'm understanding your point correctly...
- stock_toaster 11y agoI assume you can (untested) reference https endpoints with a favicon? If you can inject html though, a hidden image would probably would just as well. Although the behavior of chrome apparently still requesting the favicon file after the tab has closed, and possibly storing it in the history or bookmark file, may make this more or less appealing. Unsure. http://www.netresec.com/?page=Blog&month=2015-03&post=China%27s-Man-on-the-Side-Attack-on-GitHub http://www.netresec.com/?page=Blog&month=2015-03&post=China%...