Comment by ForHackernews
5 hours ago
Great, you have an inconvenient way to possibly-maybe see some random's gmail inbox at Starbucks.
You'd be better off just mugging them in the parking lot.
5 hours ago
Great, you have an inconvenient way to possibly-maybe see some random's gmail inbox at Starbucks.
You'd be better off just mugging them in the parking lot.
> gmail inbox
Except it won't impact gmail unless you're accessing it through curl. The browsers already distrusted the compromised intermediates via CRL within hours of disclosure, and removed the affected root via update.
No, you have a pretty easy way of intercepting someones git credentials and repo access. Arguably more dangerous than a gmail inbox.
Sure practicality is always an issue. It's an issue that attackers will go to great lengths to resolve too.
What if it's the Starbucks at 1730 Pennsylvania Ave NW, Washington, DC 20006 for an extended period of time? Compounded with other security issues like password reuse...
We can always draw a line and say, "that's not practical". The assessment an attacker is likely to do is going to be "is this practical inside my budget for the value I hope to acquire?" or maybe even just "waow, lulz".