undefined | Better HN

0 pointsgmueckl6y ago0 comments

If the inner browser has its own client certificate or simply checks for a set of known server certificates, MITM won't get you anywhere. Done right, this could well be game over.

0 comments

int_19h6y ago

For it to be truly game over, the wasm implementation it's running on must also protect the wasm payload itself, otherwise it would be trivial to patch that to MITM it.

So, on something like iOS, it could be game over (but I'm also curious what Apple is going to do with wasm there, given that it goes contrary to their strategy of being the gatekeeper for all code running on the platform). But not for the rest.

gmuecklOP6y ago

Adding a ton of obfuscation will do the trick. Patching wasm requires reverse engineering and that is very cumbersome. For Blu-Ray it took months to reverse engineer the copy protection VM and that was with a mechanism that took a lot of attention. If it's your average website, it's far easier to stay ahead of the game.

j / k navigate · click thread line to collapse

0 comments

int_19h6y ago

For it to be truly game over, the wasm implementation it's running on must also protect the wasm payload itself, otherwise it would be trivial to patch that to MITM it.

gmuecklOP6y ago

j / k navigate · click thread line to collapse