3 ms·
What privacy? Your IP and the hostname of the website you're connecting to isn't encrypted over HTTPS anyway. The content isn't sensitive and there's no cookies
by laumars 11y ago
What privacy? Your IP and the hostname of the website you're connecting to isn't encrypted over HTTPS anyway. The content isn't sensitive and there's no cookies on the site. The only remotely personal data would be your accept language header (which could be guessed from your IP) and user agent string (which you can just spoof anyway if you're really that paranoid).
The MITM argument has more merit, but even there I can't see it making much difference here given it's niche appeal. Plus given it's tech-savy bias, most people will be running a reasonably hardened system (latest patches, et al) anyway. Not the best argument against running TLS I'd admit; but still a point worth raising since the only argument for running HTTPS is to prevent malware injection.
Obviously in an ideal world everything would be served under TLS. But let's be pragmatic about which sites we bully into switching.
- macns 11y agoYour IP and the hostname of the website you're connecting to isn't encrypted over HTTPS anyway. AFAIK website hostname is visible when using SNI.
- laumars 11y agoIndeed, but SNI is more than 10 years old now so very well supported. I'd appreciate someone else correcting me if I'm wrong here, but I believe SNI is also enabled by default (where it's supported). In any case, even without the hostname header, it doesn't take much research to find a short list of possible candidates (eg https://www.virustotal.com/en/ip-address/193.0.6.136/information/ https://www.virustotal.com/en/ip-address/193.0.6.136/informa...).
- macns 11y agoThanks for going deep into this, let me add though that it's not about an ideal world or bullying, HTTPS should be the default. Lets Encrypt managed that for us already, pretty soon it will be the default.