3 ms·
Well the queries to google use https, so ISPs and government monitors shouldn't be able to see the queries. If you have malware on your computer, or if Google i
by Buge 10y ago
Well the queries to google use https, so ISPs and government monitors shouldn't be able to see the queries. If you have malware on your computer, or if Google is giving your search history out to despot countries (I don't think they are), you might be worried.
- coenhyde 10y agoGoogle doesn't do certificate pinning with HPKP. So nothing stopping a despot country from using certs signed by a valid CA. And of course there are compromised CA's. The US is just smart enough not to do this for mass collection, otherwise they'll get caught.
- Buge 10y agoIt seems that Google does public key pinning, but possibly only through preloaded lists in browsers such as Chrome and Firefox. This blog post mentions them catching a bogus google.com cert from a trusted root https://security.googleblog.com/2015/03/maintaining-digital-certificate-security.html https://security.googleblog.com/2015/03/maintaining-digital-... This says Google does use HPKP, but I don't see headers myself. https://calomel.org/http_public_key_pinning_hpkp.html https://calomel.org/http_public_key_pinning_hpkp.html
- coenhyde 10y agoInteresting. A search in chrome://net-internals/#hsts for Google does indeed show the public key pinning. I guess they do own Chrome and could get their public key hashes baked into other browsers too.