7 ms·
The very fact that an organization like the Nieman Foundation can publish something like this article without first having the good sense of enabling required T
by olivierlacan 10y ago
The very fact that an organization like the Nieman Foundation can publish something like this article without first having the good sense of enabling required TLS on their website is frighteningly careless.
Anyone from governmental agencies who read this article at home or work can now fairly easily be targeted by the relevant surveillance agencies.
- exhilaration 10y agoI'm confused, what would TLS do? The surveillance agencies can log an HTTPS URL as easily as an HTTP URL, they don't need to see the contents to see that you requested it.
- hackcasual 10y agoThey can log the domain you connected to, not the URL you visited
- jvdh 10y agoAlthough with most TLS implementations they will see the size of your transfers, thus still giving away which URL you visited....
- mi100hael 10y agoIdea: HTTP server module that appends a minimal amount of hidden random garbage data (as a comment or similar) to each response so no two responses have the same fingerprint.
- moonlighter 10y agouser btown answered that elsewhere here in this thread: "https://github.com/technion/mod_randpad https://github.com/technion/mod_randpad (an Nginx module that injects padding as a comment into returned HTML documents) is likely the correct layer to add random padding; the performance hit would be negligible."
- tyrust 10y agoIf this is the first (and only) time someone visited the domain around the time of a leak, it may be a little suspicious.
- UnoriginalGuy 10y agoThen use public WiFi.
- deleted 10y ago[deleted]
- Gnewt 10y agoIf they can't see the contents, they also can't see the URL -- both are encrypted.
- olivierlacan 10y agoNo, HTTPS URLs are not logged in plain text as they are in HTTP. So it does make an important difference. See: http://security.stackexchange.com/a/2916/50175 http://security.stackexchange.com/a/2916/50175
- jvdh 10y agoIf you mean "logging" as in web server logs, then it completely depends on the configuration of the server and there is nothing the client can do about it.. If you mean "transferring over the network", then yes, HTTPS only shows the server you are connecting to, but not the specific URL. Then again, that can be deduced from the transfer sizes that are still shown.
- mcherm 10y agoNot true. HTTPS encrypts the URL as well as the content of the communication. Someone surveilling the conversation with the ability to observe all network traffic but without the ability to decrypt SSL traffic would be able to tell that the end user had viewed something at a particular website (technically, at a particular server), but would NOT be able to tell WHICH article was viewed.
- detaro 10y agoI wonder how much that actually gains for this specific case ("which article did IP $x view?"). With more effort, it should be fairly easy to match the traffic pattern to the article, e.g. by matching the size of subsequent requests for the images. But more complicated than a simple filter that just grabs all URLs from HTTP.
- ethbro 10y ago> With more effort That's the new key point for 2017 pro-privacy architectures. Proof of work surveillance doesn't scale because requiring it leverages the disparity between the total level of Internet traffic and intelligence agency resources. Kill the dragnets as step 1, then worry about step 2.
- deathhand 10y agoIt would be helpful to have a website to display a random image of differing sizes for every page load. This would prevent fingerprinting https.
- pixl97 10y agoUm, I don't believe that would help. You either inline the images as data, or better, get rid of all images and have random length non-printing text to hide the real data. This kills caching and performance though.
- 10y ago
- jakelazaroff 10y agoIt's worse than just knowing the URL. HTTP pages can be altered without your knowledge by a malicious third party: http://security.stackexchange.com/a/72661 http://security.stackexchange.com/a/72661 So a surveillance agency could e.g. replace the URLs for the various organizations' leaks landing pages and Tor addresses with phishing pages, and anyone who used them would upload documents directly to the agency.
- bweitzman 10y agoThey're also leaving themselves open to MITM attacks, where an attacker could change all of the tor addresses.
- chime 10y agoEven SSL sites are not immune. On corporate networks, the clients trust the company cert, which is used to proxy all traffic (including HSTS and HPKP/pinned sites) for filtering/logging.
- Spivak 10y agoIf you don't trust the machine you're currently on then it's already game over from a security perspective.
- jakelazaroff 10y agoIsn't the actual content of the page signed by the the site's certificate though? And they can't just serve a different certificate because your browser can tell whether or not it was issued by a trusted CA. How does the attack work in this case? Edit: Nevermind — I assume you're referring to this scenario[1], in which the company installs a root certificate onto your actual computer that allows them to sign certificates for other sites. [1] http://security.stackexchange.com/a/63306 http://security.stackexchange.com/a/63306
- tracker1 10y agoA lot of corporate computers have at least an additional CA authority on each computer that they use... if you're using a corporate computer, it's really easy for them to MITM any request, just relaying requests to the public resource, then proxying and using their CA signed cert in the proxy. From there, everything can be tracked.
- organsnyder 10y agoIf you have a corporate computer, you shouldn't rely on any expectation of privacy. There's nothing stopping them from installing other monitoring software—screen grabbers, keyloggers, etc.—whenever they please.
- Spooky23 10y agoIf you're at work at a place where reporters would give a hoot about what you have to say, most likely your TLS sessions are intercepted at the proxy. It's less common for companies to have content inspection.
- EdHominem 10y agoAll the SSL MitM products I've seen can do content inspection. Not yet for freeform text though who knows...
- snowwrestler 10y agoBut why would they bother. The point of collecting data for surveillance is to provide signals that help sort the real threats from the noise. But the Nieman Foundation is such a well-known and widely-read blog that just reading an article there is not at all noteworthy, regardless of the subject. Most government employees are not even in a position to access leakable data even they wanted to. Targeting them based on reading an article would be a waste of effort.