Interestingly, DDoS attacks against Wikileaks can only delay dissemination of information a little bit. DDoS attacks against PayPal, on the other hand, can be effective in costing them real money, for every hour they are down.

If I were attacking them, I would target the APIs that merchants use instead of the main site. The main site has probably been DDoSed before, APIs are a subtler target. I imagine a successful attack there would have a broader and deeper impact.

Also, have browsers been used for DDoS before? I imagine with the popularity Wikileaks has, you can ask people to keep a page open if they want to participate, and share that page on Twitter/Reddit/Facebook. The page would repeatedly create requests loading the target urls in an iframe or as a script tag.

In this approach one would have to get rid of the referrer header, I guess. So open the urls using SSL. The SSL handshake would cause additional load.

Not sure how effective would that be compared to a traditional botnet that can delay TCP and SSL handshakes; things browsers can't do.