3 ms·

From the post: "Well a big one: Privacy of the readers of Pepper&Carrot." Before even thinking about tossing things like Google Fonts or AddThis or whatever,

by mark242 10y ago

From the post: "Well a big one: Privacy of the readers of Pepper&Carrot." Before even thinking about tossing things like Google Fonts or AddThis or whatever, the very first thing you need to do is turn on HTTPS. If you're concerned about privacy, or content injection, or MITM attacks, or name-your-poison-here, you must immediately only serve up pages via HTTPS with strong encryption.

fencepost 10y ago
Those are to a large extent different problems. For one you are eliminating requests to outside hosts from your own website and thus avoiding having those outside hosts track your users. For the other, adding encryption, you're preventing the carrier being used at either end or in between from tracking which pages on the site are visited but not so effectively whether the site was visited at all. Without the libraries being loaded Google and other CDN Library providers have no way of knowing whether I have visited that site unless they are also providing the underlying network connection that I am using.
mpweiher 10y ago
These seem completely independent to me. - HTTPS is for attacks. - What the article describes is run-of-the-mill tracking by Google etc. If I am not being attacked, the CDN resources will still allow Google to track me. If I am being attacked the CDN resources will still allow Google to track me. If I don't have these Google resources (let's just use Google resources for now), I don't think that Google will MITM me.
- Klathmon 10y ago
  Google might not MITM you, but a shitty wifi router, your ISP, a hotspot, a hacked device on your network, or the government, and more can and will MITM you. Time and time again you see stories of people having tracking, ads, and malware injected into their browsing from free wifi, most ISPs, cell providers, hacked wifi routers, or even antivirus software. Enabling HTTPS is THE baseline, there's no excuse not to have it.
- pdkl95 10y ago
  > HTTPS is for attacks. You are always under attack on the internet. This isn't really hyperbole. While I'm sure it's possible to find the occasional exception, you really need to assume all internet traffic could be hostile. - Verison vandalizes most of the plaintext HTTP by adding their X-UIDH[1] tracking-id header. - I's common to see Javascript appended to HTML files when they are sent over HTTP on a cellular network. (it replaces images URLs with a very highly compressed version). - If the HTTP socket intersects Great Firewall, more injected Javascript might conscript your browser into the Great Cannon[2]. (also: the "QUANTUJM" suite of tools that use packet races for similar purposes) - One of the goals is the privacy of the readers. Google isn't the only attacker, and MitM is only one type of attack. If you aren't encrypting, your requests being analyzed - probably several times - with DPI[3]. If you aren't encryption, you are enabling passive surveillance. That's just some of the obvious stuff. [1] https://www.verizonwireless.com/support/unique-identifier-header-faqs/ https://www.verizonwireless.com/support/unique-identifier-he... [2] https://citizenlab.org/2015/04/chinas-great-cannon/ https://citizenlab.org/2015/04/chinas-great-cannon/ [3] https://en.wikipedia.org/wiki/Deep_packet_inspection https://en.wikipedia.org/wiki/Deep_packet_inspection
- throwawasiudy 10y ago
  Without https MANY places will silently MITM your connection. I remember reading that a major site, I think netflix, was having a low consistent level of page load failures and couldn't figure it out. When they went to HTTPS all the problems went away, apparently the culprit was code and HTML injected into their pages by 1) wifi hotspots - this is REALLY common, how do you think they redirect you to their login page? 2) content filters like sonicwall - I used to work in an IT consulting shop, these are EVERYWHERE. And they don't just filter, they record every page of every site you visit. Expect any non-residential wifi to be reading all of your non-encrypted traffic. 3) crappy ISP's trying to serve ads 4) bad actors on public wifi - this is common at the airport, meeting halls, and conventions. Even encrypted wifi is vulnerable as long as the attacker is on the same network (if they have wireless isolation off, which most places do for printers).
Klathmon 10y ago
The worst part is that HTTPS is there and works, all they need to do is add the HSTS header and they would instantly improve the security of every single visitor for free. I generally hate when people point out things like "if you really cared about your users like you said you do, you'd implement [unrelated thing]", but in this case it's an extremely small change that would improve the privacy for every single one of their visitors.

by mark242 10y ago

fencepost 10y ago

Those are to a large extent different problems. For one you are eliminating requests to outside hosts from your own website and thus avoiding having those outside hosts track your users. For the other, adding encryption, you're preventing the carrier being used at either end or in between from tracking which pages on the site are visited but not so effectively whether the site was visited at all. Without the libraries being loaded Google and other CDN Library providers have no way of knowing whether I have visited that site unless they are also providing the underlying network connection that I am using.

mpweiher 10y ago

These seem completely independent to me. - HTTPS is for attacks. - What the article describes is run-of-the-mill tracking by Google etc. If I am not being attacked, the CDN resources will still allow Google to track me. If I am being attacked the CDN resources will still allow Google to track me. If I don't have these Google resources (let's just use Google resources for now), I don't think that Google will MITM me.

Klathmon 10y ago
Google might not MITM you, but a shitty wifi router, your ISP, a hotspot, a hacked device on your network, or the government, and more can and will MITM you. Time and time again you see stories of people having tracking, ads, and malware injected into their browsing from free wifi, most ISPs, cell providers, hacked wifi routers, or even antivirus software. Enabling HTTPS is THE baseline, there's no excuse not to have it.
pdkl95 10y ago
> HTTPS is for attacks. You are always under attack on the internet. This isn't really hyperbole. While I'm sure it's possible to find the occasional exception, you really need to assume all internet traffic could be hostile. - Verison vandalizes most of the plaintext HTTP by adding their X-UIDH[1] tracking-id header. - I's common to see Javascript appended to HTML files when they are sent over HTTP on a cellular network. (it replaces images URLs with a very highly compressed version). - If the HTTP socket intersects Great Firewall, more injected Javascript might conscript your browser into the Great Cannon[2]. (also: the "QUANTUJM" suite of tools that use packet races for similar purposes) - One of the goals is the privacy of the readers. Google isn't the only attacker, and MitM is only one type of attack. If you aren't encrypting, your requests being analyzed - probably several times - with DPI[3]. If you aren't encryption, you are enabling passive surveillance. That's just some of the obvious stuff. [1] https://www.verizonwireless.com/support/unique-identifier-header-faqs/ https://www.verizonwireless.com/support/unique-identifier-he... [2] https://citizenlab.org/2015/04/chinas-great-cannon/ https://citizenlab.org/2015/04/chinas-great-cannon/ [3] https://en.wikipedia.org/wiki/Deep_packet_inspection https://en.wikipedia.org/wiki/Deep_packet_inspection
throwawasiudy 10y ago
Without https MANY places will silently MITM your connection. I remember reading that a major site, I think netflix, was having a low consistent level of page load failures and couldn't figure it out. When they went to HTTPS all the problems went away, apparently the culprit was code and HTML injected into their pages by 1) wifi hotspots - this is REALLY common, how do you think they redirect you to their login page? 2) content filters like sonicwall - I used to work in an IT consulting shop, these are EVERYWHERE. And they don't just filter, they record every page of every site you visit. Expect any non-residential wifi to be reading all of your non-encrypted traffic. 3) crappy ISP's trying to serve ads 4) bad actors on public wifi - this is common at the airport, meeting halls, and conventions. Even encrypted wifi is vulnerable as long as the attacker is on the same network (if they have wireless isolation off, which most places do for printers).

Klathmon 10y ago

The worst part is that HTTPS is there and works, all they need to do is add the HSTS header and they would instantly improve the security of every single visitor for free. I generally hate when people point out things like "if you really cared about your users like you said you do, you'd implement [unrelated thing]", but in this case it's an extremely small change that would improve the privacy for every single one of their visitors.