Fake Server -> Greenlight about dash-button

[ide]

Cool find, thanks for sharing. Reading through the technical details I think this shows that faking the server is too hard to be worthwhile -- you need to install custom firmware on your WiFi router so that you can reroute traffic sent to Google DNS and instead spoof the DNS response.

The second thing is that the Dash button might one day validate the SSL certificates from the server it thinks is parker-gateway-na.amazon.com. It sounds like the Dash button doesn't validate them at all (which actually seems OK in this specific scenario -- the worst an attacker could do is make your Dash button light turn green) but if Amazon changed that then the Dash button wouldn't connect to the fake HTTP server anymore.