On Wed, Oct 8, 2014 at 3:56 PM, Eric Rescorla <ekr@rtfm.com> wrote: > It is not generally true that *passive* network attackers will be able to > watch or listen to users in real-time, even if gUM is used without an > authenticated origin. As Chris pointed out earlier, the difference between passive/active is (becoming) marginal: http://lists.w3.org/Archives/Public/public-media-capture/2014Oct/0071.html Given the low cost, the vast amounts of information that could be collected in this way (even from normally authenticated but now sslstripped spoofed resources), it seems very likely this would be pursued. -- https://annevankesteren.nl/Received on Wednesday, 8 October 2014 14:30:30 UTC
This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 16:26:30 UTC