News for hackers. Stuff that matters.

A comment on Comparing HTTP/3 vs. HTTP/2 Performance. Parent comment

Re:Comparing HTTP/3 vs. HTTP/2 Performance by Matthias247 on Tuesday April 14, 2020 @01:40PM (#22868940)
Those are addressed by the QUIC specification, by having lots of encryption. The whole content of QUIC packets is encrypted. You can't really do a lot with connection IDs. And for most of the packets you can't even observe the full connection ID, since an abbreviated version is sent.

Acknowledgements are encrypted.

[ Parent | on HN ]
Re:Comparing HTTP/3 vs. HTTP/2 Performance by labawi on Tuesday April 14, 2020 @02:50PM (#22869906)
Can the transport path be hijacked from a single captured packet? As in capture a single packet, scribble an address and the connection now goes via Pentagon or China.

I know it's possible for wireguard, maybe mosh.

[ Parent | on HN ]
Re:Comparing HTTP/3 vs. HTTP/2 Performance by keithwinstein on Tuesday April 14, 2020 @03:07PM (#22870118)
No -- Mosh is careful to make sure that a transient network attack can only result in a transient application-layer consequence. So a single misrouted IP datagram can't permanently affect the connection. Mosh does this at the cost of having client-only mobility; the client keeps sending to the same server address for the life of the connection.
[ Parent | on HN ]