Subject: Re: [TLS] Duong and Rizzo, the actual attack

From: Florian Weimer <[email-masked]>
Date: Sat, 01 Oct 2011 16:22:41 +0000

* Eric Rescorla:

> I'm also not Adam Langley, but here's my writeup:
> http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html

I think a semi-passive eavesdropper (which is present under this threat
model) can bypass the same-origin protection in practically all cases.
An attacker which can route requests through the browser and can
otherwise only observe traffic, but not inject it, seems a rather
unrealistic scenario to me.  If you can observe traffic, clairvoyant DNS
spoofing should be possible, and with that, SOP falls completely.  The
Oracle browser plugin for Java some folks seem to concentrate on is
probably not that relevant.

Anyway, is there are full writeup?  The copies of the paper I've seen
still has many blank sections.

-- 
Florian Weimer                <[email-masked]>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: +49-721-96201-1
D-76133 Karlsruhe             fax: +49-721-96201-99