5 ms·

the web page is https but tries to load the map over http :(

godzillabrennus 11y ago
And? Why does it need to be secured? After all it's an ancient map. Unless of course you are afraid someone will snoop on your plans with Doc Brown?
- jjuhl 11y ago
  Using https (encryption) always is not just about keeping content secret. It is also about ensuring content was not tampered with and ensuring you got the content from the source you expect. In addition to that there's the whole debate about encrypting everything because otherwise if only sensitive stuff is using encryption it's that much easier to pinpoint sensitive stuff for metadata analysis etc. Much better if everything is just encrypted by default.
  - yeukhon 11y ago
    True (plus no more mixed content warning) but not exactly 100% of the picture, warrants a footnote here. Unless you actually know which source you expect to get from, you can't tell if https://evil.com/evil.js https://evil.com/evil.js is intended over https://legit.com/legit.js https://legit.com/legit.js. In the end, they are over https, and authenticated. From a user point of view, I am not sure how we can actually defend that, but as an author of a page, you can try to enforce expectation with various HTTP headers (CSP, suborigin integrity). Authentication is one thing, but determining the integrity is another.
- infinity0 11y ago
  It needs to be authenticated because I don't want to run injected javascript. (I have no idea if the inner frame contains javascript. My browser blocked it for me by default. That is the correct and good behaviour.) > After all it's an ancient map. It needs to be encrypted because I don't want other people to know that I'm browsing the ancient map. The map itself is public, the fact that I am reading it need not be public. Why are you afraid that I don't want you to know my reading list? Would you tell me yours?
  - gist 11y ago
    I never though of it that way. An interesting idea that I had was quite the opposite. Run a program that does totally random searches and web page requests (with appropriate headers) in order to create so much info as to render it useless to anyone spying. Almost like if you were running a public proxy. Reminds me of an old Perry Mason episode where he had 25 guys help him move a car to create a bunch of fingerprints. Maybe it wasn't Perry Mason but some crime show but that was the concept.
    - infinity0 11y ago
      You might be interested in this: https://cs.nyu.edu/trackmenot/ https://cs.nyu.edu/trackmenot/ However, the difficulty is to make these requests actually look indistinguishable from normal browsing. It might "work OK" now, but the behaviour certainly is different from normal browsing habits. If everyone started using this, you can bet someone would pour a lot of money into research that filters out the automated requests. Then one basically needs to solve steganography, which is a hard problem, harder than cryptography.
      - gist 11y ago
        That's interesting thanks for that. I wonder if someone could put together a product that would just sit on the network and do the same thing unattended 24x7 that didn't have to be installed as an extension.
  - toyg 11y ago
    > Why are you afraid that I don't want you to know my reading list? Would you tell me yours? I agree with your privacy-oriented attitude and the bug report, but this sentence made me think that: 1) lots of people love to share their reading lists. Yes, of course it's always an edited version (which enables privacy), but still... 2) ... websites like this very one are basically aggregated reading lists we all share. Others like Goodreads are basically just shared reading lists for offline content. 3) There are some browser plugins that tried to build communities around webpages, i.e. you'd go to a webpage and see other people reading it at the same time. They never seemed to get much traction. However... 4) ... would I like a system where I submit my browser history and get back recommendations for other pages or for communities to join? Yeah, I'd like that. Huge privacy implications, sure, but I bet a lot of people wouldn't mind trading some privacy with an automated entity if it means getting back more meaningful connections. In practice, Google Search does that already. In the end, for most people the problem is to share more, in order to establish significant connections and augment their own knowledge, the issue only being who or what we're sharing with. We all joke that our browser history is horrible, but we would love nothing more than a nonjudgmental entity that can use it to improve our life.

And? Why does it need to be secured? After all it's an ancient map. Unless of course you are afraid someone will snoop on your plans with Doc Brown?

jjuhl 11y ago
Using https (encryption) always is not just about keeping content secret. It is also about ensuring content was not tampered with and ensuring you got the content from the source you expect. In addition to that there's the whole debate about encrypting everything because otherwise if only sensitive stuff is using encryption it's that much easier to pinpoint sensitive stuff for metadata analysis etc. Much better if everything is just encrypted by default.
- yeukhon 11y ago
  True (plus no more mixed content warning) but not exactly 100% of the picture, warrants a footnote here. Unless you actually know which source you expect to get from, you can't tell if https://evil.com/evil.js https://evil.com/evil.js is intended over https://legit.com/legit.js https://legit.com/legit.js. In the end, they are over https, and authenticated. From a user point of view, I am not sure how we can actually defend that, but as an author of a page, you can try to enforce expectation with various HTTP headers (CSP, suborigin integrity). Authentication is one thing, but determining the integrity is another.
infinity0 11y ago
It needs to be authenticated because I don't want to run injected javascript. (I have no idea if the inner frame contains javascript. My browser blocked it for me by default. That is the correct and good behaviour.) > After all it's an ancient map. It needs to be encrypted because I don't want other people to know that I'm browsing the ancient map. The map itself is public, the fact that I am reading it need not be public. Why are you afraid that I don't want you to know my reading list? Would you tell me yours?
- gist 11y ago
  I never though of it that way. An interesting idea that I had was quite the opposite. Run a program that does totally random searches and web page requests (with appropriate headers) in order to create so much info as to render it useless to anyone spying. Almost like if you were running a public proxy. Reminds me of an old Perry Mason episode where he had 25 guys help him move a car to create a bunch of fingerprints. Maybe it wasn't Perry Mason but some crime show but that was the concept.
  - infinity0 11y ago
    You might be interested in this: https://cs.nyu.edu/trackmenot/ https://cs.nyu.edu/trackmenot/ However, the difficulty is to make these requests actually look indistinguishable from normal browsing. It might "work OK" now, but the behaviour certainly is different from normal browsing habits. If everyone started using this, you can bet someone would pour a lot of money into research that filters out the automated requests. Then one basically needs to solve steganography, which is a hard problem, harder than cryptography.
    - gist 11y ago
      That's interesting thanks for that. I wonder if someone could put together a product that would just sit on the network and do the same thing unattended 24x7 that didn't have to be installed as an extension.
- toyg 11y ago
  > Why are you afraid that I don't want you to know my reading list? Would you tell me yours? I agree with your privacy-oriented attitude and the bug report, but this sentence made me think that: 1) lots of people love to share their reading lists. Yes, of course it's always an edited version (which enables privacy), but still... 2) ... websites like this very one are basically aggregated reading lists we all share. Others like Goodreads are basically just shared reading lists for offline content. 3) There are some browser plugins that tried to build communities around webpages, i.e. you'd go to a webpage and see other people reading it at the same time. They never seemed to get much traction. However... 4) ... would I like a system where I submit my browser history and get back recommendations for other pages or for communities to join? Yeah, I'd like that. Huge privacy implications, sure, but I bet a lot of people wouldn't mind trading some privacy with an automated entity if it means getting back more meaningful connections. In practice, Google Search does that already. In the end, for most people the problem is to share more, in order to establish significant connections and augment their own knowledge, the issue only being who or what we're sharing with. We all joke that our browser history is horrible, but we would love nothing more than a nonjudgmental entity that can use it to improve our life.