Comment by ptaipale

The subject line says HTTP only. Does this attack work over HTTPS?