I think these two paragraphs are critical for the lay reader:

"This said, it would be incorrect to describe the attacks as being a practical threat to TLS and WPA today. However, our attacks are open to further enhancement, using, for example, the ability of our algorithms to output likelihoods for candidate plaintext bytes coupled with more sophisticated plaintext models."

"We recognise that, with around 50% of TLS traffic currently using RC4, recommending that it be avoided completely in TLS is not a suggestion to be made lightly. Nevertheless, given the rather small security margin provided by RC4 against our attacks, our recommendation is that RC4 should henceforth be avoided in TLS, and deprecated as soon as possible."

I dispute the first graf for three reasons. First, the attack (you can play with it yourself; it's one of our upcoming crypto challenges) is relative to the start of the art in cryptography devastatingly easy to carry out; it takes a large amount of time, and may not be suitable for mass attacks, but one can imagine circumstances today in which this attack could be workable for targeted high-value secrets. Second, the kinds of advances in this attack that will make it more viable are less likely to be cryptographic and more likely to be systems programming related; as people play with the attack and explore more of the interactions between browsers and (say) specific RC4 bias positions, I think we're likely to find "non-cryptographic" (to coin a term) refinements of the attack that will make it scarier. The tempo of these kinds of advances is much, much faster than the tempo of fundamental advances in crypto. Finally, I think that graf doesn't adequately capture the other circumstances in which RC4 is used --- it's not a hair-on-fire operational issue for the web today, but it might be hair-on-fire for less well-understood cryptosystems.

So, given that virtually every HTTP request has a uniform header, you'd need an adequate number of requests to the same page. That sounds impractical, but it won't stay that way for long. 2^24 is only 16.77 million requests, something not-so-difficult to achieve by a botnet, especially on sites that scale well (slower sites would be safer, actually).

Is it possible that at least some of the high-profile "DDOS" attacks on Mt.Gox that took place earlier this year[0] were actually attempted RC4 attacks? There would have been a payoff worth the effort. I checked, and indeed Mt. Gox was using (and still uses) RC4[1]:

0. https://mtgox.com/press_release_20130404.html

1. http://security.stackexchange.com/questions/18863/how-secure...

The goal with this attack is to listen in on (and have some degree of control of the plaintext contained in) requests between the server and a specific client. A botnet wouldn't help you do that.

The sentence immediately preceding what you quoted is necessary for understanding:

> Suppose byte Zr of the RC4 keystream has a dominant bias towards value 0x00.

It's necessary to understand why the attack works, but not so much for understanding how to implement it. But you're right.