5 ms·
This is super irresponsible to have on HN. Not funny. Especially for people who live in despot countries. Not sure if the USA counts quite yet.
by coenhyde 10y ago
This is super irresponsible to have on HN. Not funny. Especially for people who live in despot countries. Not sure if the USA counts quite yet.
- mlvljr 10y agoc'mon, harmless to us Russian folks (=> doesn't count :P ), AND NO COOKIE BONBS in the list, you are fine, too!
- Buge 10y agoWell the queries to google use https, so ISPs and government monitors shouldn't be able to see the queries. If you have malware on your computer, or if Google is giving your search history out to despot countries (I don't think they are), you might be worried.
- coenhyde 10y agoGoogle doesn't do certificate pinning with HPKP. So nothing stopping a despot country from using certs signed by a valid CA. And of course there are compromised CA's. The US is just smart enough not to do this for mass collection, otherwise they'll get caught.
- Buge 10y agoIt seems that Google does public key pinning, but possibly only through preloaded lists in browsers such as Chrome and Firefox. This blog post mentions them catching a bogus google.com cert from a trusted root https://security.googleblog.com/2015/03/maintaining-digital-certificate-security.html https://security.googleblog.com/2015/03/maintaining-digital-... This says Google does use HPKP, but I don't see headers myself. https://calomel.org/http_public_key_pinning_hpkp.html https://calomel.org/http_public_key_pinning_hpkp.html
- coenhyde 10y agoInteresting. A search in chrome://net-internals/#hsts for Google does indeed show the public key pinning. I guess they do own Chrome and could get their public key hashes baked into other browsers too.