- From: Anne van Kesteren <annevk@annevk.nl>
- Date: Wed, 8 Oct 2014 16:30:00 +0200
- To: Eric Rescorla <ekr@rtfm.com>, Chris Palmer <palmer@google.com>
- Cc: Justin Uberti <juberti@google.com>, Stefan Håkansson LK <stefan.lk.hakansson@ericsson.com>, "public-media-capture@w3.org" <public-media-capture@w3.org>
On Wed, Oct 8, 2014 at 3:56 PM, Eric Rescorla <ekr@rtfm.com> wrote: > It is not generally true that *passive* network attackers will be able to > watch or listen to users in real-time, even if gUM is used without an > authenticated origin. As Chris pointed out earlier, the difference between passive/active is (becoming) marginal: http://lists.w3.org/Archives/Public/public-media-capture/2014Oct/0071.html Given the low cost, the vast amounts of information that could be collected in this way (even from normally authenticated but now sslstripped spoofed resources), it seems very likely this would be pursued. -- https://annevankesteren.nl/
Received on Wednesday, 8 October 2014 14:30:30 UTC