4 ms·

"I'm all in favor of news sites using HTTPS, but I assume they're also going to pad all their articles to a uniform length?" Source: https://twitter.com/matthe

by bonyt 10y ago

"I'm all in favor of news sites using HTTPS, but I assume they're also going to pad all their articles to a uniform length?" Source: https://twitter.com/matthew_d_green/status/535043126248095744 https://twitter.com/matthew_d_green/status/53504312624809574...

Klathmon 10y ago
This isn't an "all or nothing" situation. Enabling HTTPS is a benefit even if it's not perfect. The integrity and authentication it provides are alone a MASSIVE benefit (especially for a news site). Now you'll know that your news is coming from their servers, and nobody else is tampering with it. Then taking into account that it does provide confidentiality, you get rid of "dragnet" style data gathering and inspection. You'd need to be targeted by someone who not only has a lot of time, but also is very up to date on the pages of NYT and their sizes to be able to track your article by its size. No matter what, it's still harder than it was before to snoop on what you are doing. It's a net gain in just about every single way.
- jczhang 10y ago
  "Now you'll know that your news is coming from their servers, and nobody else is tampering with it." I'm a HTTPS noob, can you explain how or why someone would tamper it on normal HTTP? Who would care to target me and what are the chances that NYT has been tampered with ever before?
  - grzm 10y ago
    I'll leave the "how" to any of the many resources out there that describe how HTTPS works. As to why, there's probably low likelihood that someone is tampering with your connection to the NYT. It's good practice, however, and is (largely) transparent to the user. My house may not have ever been broken into before, and likely not going to be broken into in the future, though I still lock my door.
  - EvilTerran 10y ago
    To take an example that's already happened... How? By being the user's ISP. Why? To inject adverts. What are the chances it affected nytimes.com? Almost certain. Behold: http://arstechnica.com/tech-policy/2014/09/why-comcasts-javascript-ad-injections-threaten-security-net-neutrality/ http://arstechnica.com/tech-policy/2014/09/why-comcasts-java... - and that's not the only case of it.
    - Klathmon 10y ago
      And as that last link points out, this isn't a theoretical thing. Not only do ISPs do it, but wifi hotspots, dodgy wifi routers, malware on anything in-between, and in some (admittedly rare cases) your government. And the why isn't just ads. But passive tracking (ISPs have been known to analyze your traffic passively and sell that information), active tracking (the famous Verizon super cookie), "page optimization" which frequently breaks sites, and in some cases malware injection into images, executables, or anything else the bad actor could do automatically.
- jczhang 10y ago
  "Now you'll know that your news is coming from their servers, and nobody else is tampering with it." I'm a HTTPS noob, can you explain how or why someone would tamper it on normal HTTP? Who would care to target me and what are the chances that NYT has been tampered with ever before?
nathan_f77 10y ago
That's an interesting point. An eavesdropper would be able to figure out which article you're reading. It might sound silly to worry about this, but you need to be careful in some countries. This is an interesting puzzle. How much data do you need to add to a page before it becomes impossible (or at least, reasonably difficult) to guess which article someone is reading? I tried to figure out, but then I remembered that I don't know anything about statistics. Oh well, I had fun: https://github.com/ndbroadbent/nyt_privacy https://github.com/ndbroadbent/nyt_privacy

by bonyt 10y ago

Klathmon 10y ago

This isn't an "all or nothing" situation. Enabling HTTPS is a benefit even if it's not perfect. The integrity and authentication it provides are alone a MASSIVE benefit (especially for a news site). Now you'll know that your news is coming from their servers, and nobody else is tampering with it. Then taking into account that it does provide confidentiality, you get rid of "dragnet" style data gathering and inspection. You'd need to be targeted by someone who not only has a lot of time, but also is very up to date on the pages of NYT and their sizes to be able to track your article by its size. No matter what, it's still harder than it was before to snoop on what you are doing. It's a net gain in just about every single way.

jczhang 10y ago
"Now you'll know that your news is coming from their servers, and nobody else is tampering with it." I'm a HTTPS noob, can you explain how or why someone would tamper it on normal HTTP? Who would care to target me and what are the chances that NYT has been tampered with ever before?
- grzm 10y ago
  I'll leave the "how" to any of the many resources out there that describe how HTTPS works. As to why, there's probably low likelihood that someone is tampering with your connection to the NYT. It's good practice, however, and is (largely) transparent to the user. My house may not have ever been broken into before, and likely not going to be broken into in the future, though I still lock my door.
- EvilTerran 10y ago
  To take an example that's already happened... How? By being the user's ISP. Why? To inject adverts. What are the chances it affected nytimes.com? Almost certain. Behold: http://arstechnica.com/tech-policy/2014/09/why-comcasts-javascript-ad-injections-threaten-security-net-neutrality/ http://arstechnica.com/tech-policy/2014/09/why-comcasts-java... - and that's not the only case of it.
  - Klathmon 10y ago
    And as that last link points out, this isn't a theoretical thing. Not only do ISPs do it, but wifi hotspots, dodgy wifi routers, malware on anything in-between, and in some (admittedly rare cases) your government. And the why isn't just ads. But passive tracking (ISPs have been known to analyze your traffic passively and sell that information), active tracking (the famous Verizon super cookie), "page optimization" which frequently breaks sites, and in some cases malware injection into images, executables, or anything else the bad actor could do automatically.
jczhang 10y ago
"Now you'll know that your news is coming from their servers, and nobody else is tampering with it." I'm a HTTPS noob, can you explain how or why someone would tamper it on normal HTTP? Who would care to target me and what are the chances that NYT has been tampered with ever before?

nathan_f77 10y ago

That's an interesting point. An eavesdropper would be able to figure out which article you're reading. It might sound silly to worry about this, but you need to be careful in some countries. This is an interesting puzzle. How much data do you need to add to a page before it becomes impossible (or at least, reasonably difficult) to guess which article someone is reading? I tried to figure out, but then I remembered that I don't know anything about statistics. Oh well, I had fun: https://github.com/ndbroadbent/nyt_privacy https://github.com/ndbroadbent/nyt_privacy