Just by having a forged SSL Certificate for ssl.google-analytics.com how can they supply their javscript ? The request still goes to the google servers and not to any evil-democracy-suppressors.gov.ir
So sure if they could reroute the request to their servers evil things could be done. But they can NOT. Or am i missing something ?
So sure if they could reroute the request to their servers evil things could be done. But they can NOT. Or am i missing something ?