Re:Security Vulnerability in Browser Interface Allows Comput...
by bastawhiz on Wednesday April 17, 2024 @10:14AM
(#40064933)
That assumes the encrypted content is transferred in plaintext (not over https). I think you'd be hard pressed to find a HTTPS client that decrypts on the GPU. And then of course, the thing being decrypted needs to be big enough for the process to take long enough for them to perform the attack, which means many gigabytes (terabytes?). And then you'd still need to send the data from the mitm server back to the browser for processing before you start measuring anything.
It's obvious they accomplished something, but the scenario they set up simply isn't something that is practical in the real world
Re:Security Vulnerability in Browser Interface Allows Comput...
by freeone3000 on Wednesday April 17, 2024 @10:33AM
(#40065208)
DRM-encrypted streaming video, perhaps? Gigabytes of encrypted data that needs to be decrypted and displayed?
Re:Security Vulnerability in Browser Interface Allows Comput...
by bastawhiz on Wednesday April 17, 2024 @10:44AM
(#40065377)
But you've still got to shuttle that data to the browser and it has to be decrypted on the GPU. I think you'd be hard pressed to find that anywhere in the wild.
Modern CPUs can decrypt AES with specialized instructions at a rate that's practically measured in GB/s. Especially for streaming video that doesn't need to decrypt the full stream at once (and where you're probably already using the GPU to, you know, render the video) why would you use the GPU for AES?
MITM attacks are usually considered relatively easy to pull off. Run a fake wifi-hotspot in an airport, use the "login portal" to get access to their browser, use the hotspot itself to get access to the cipher texts when they visit other https page (edit: I suppose those would be decrypted on the CPU... but when they use whatever odd program that thought decrypting messages to it on the GPU is a good idea).