8 ms·

I'm confused, what would TLS do? The surveillance agencies can log an HTTPS URL as easily as an HTTP URL, they don't need to see the contents to see that you r

I'm confused, what would TLS do? The surveillance agencies can log an HTTPS URL as easily as an HTTP URL, they don't need to see the contents to see that you requested it.

hackcasual 10y ago
They can log the domain you connected to, not the URL you visited
- jvdh 10y ago
  Although with most TLS implementations they will see the size of your transfers, thus still giving away which URL you visited....
  - mi100hael 10y ago
    Idea: HTTP server module that appends a minimal amount of hidden random garbage data (as a comment or similar) to each response so no two responses have the same fingerprint.
    - moonlighter 10y ago
      user btown answered that elsewhere here in this thread: "https://github.com/technion/mod_randpad https://github.com/technion/mod_randpad (an Nginx module that injects padding as a comment into returned HTML documents) is likely the correct layer to add random padding; the performance hit would be negligible."
- tyrust 10y ago
  If this is the first (and only) time someone visited the domain around the time of a leak, it may be a little suspicious.
  - UnoriginalGuy 10y ago
    Then use public WiFi.
deleted 10y ago
[deleted]
Gnewt 10y ago
If they can't see the contents, they also can't see the URL -- both are encrypted.
olivierlacan 10y ago
No, HTTPS URLs are not logged in plain text as they are in HTTP. So it does make an important difference. See: http://security.stackexchange.com/a/2916/50175 http://security.stackexchange.com/a/2916/50175
- jvdh 10y ago
  If you mean "logging" as in web server logs, then it completely depends on the configuration of the server and there is nothing the client can do about it.. If you mean "transferring over the network", then yes, HTTPS only shows the server you are connecting to, but not the specific URL. Then again, that can be deduced from the transfer sizes that are still shown.
mcherm 10y ago
Not true. HTTPS encrypts the URL as well as the content of the communication. Someone surveilling the conversation with the ability to observe all network traffic but without the ability to decrypt SSL traffic would be able to tell that the end user had viewed something at a particular website (technically, at a particular server), but would NOT be able to tell WHICH article was viewed.
- detaro 10y ago
  I wonder how much that actually gains for this specific case ("which article did IP $x view?"). With more effort, it should be fairly easy to match the traffic pattern to the article, e.g. by matching the size of subsequent requests for the images. But more complicated than a simple filter that just grabs all URLs from HTTP.
  - ethbro 10y ago
    > With more effort That's the new key point for 2017 pro-privacy architectures. Proof of work surveillance doesn't scale because requiring it leverages the disparity between the total level of Internet traffic and intelligence agency resources. Kill the dragnets as step 1, then worry about step 2.
    - deathhand 10y ago
      It would be helpful to have a website to display a random image of differing sizes for every page load. This would prevent fingerprinting https.
      - pixl97 10y ago
        Um, I don't believe that would help. You either inline the images as data, or better, get rid of all images and have random length non-printing text to hide the real data. This kills caching and performance though.
        10y ago
jakelazaroff 10y ago
It's worse than just knowing the URL. HTTP pages can be altered without your knowledge by a malicious third party: http://security.stackexchange.com/a/72661 http://security.stackexchange.com/a/72661 So a surveillance agency could e.g. replace the URLs for the various organizations' leaks landing pages and Tor addresses with phishing pages, and anyone who used them would upload documents directly to the agency.

I'm confused, what would TLS do? The surveillance agencies can log an HTTPS URL as easily as an HTTP URL, they don't need to see the contents to see that you requested it.

hackcasual 10y ago

They can log the domain you connected to, not the URL you visited

jvdh 10y ago
Although with most TLS implementations they will see the size of your transfers, thus still giving away which URL you visited....
- mi100hael 10y ago
  Idea: HTTP server module that appends a minimal amount of hidden random garbage data (as a comment or similar) to each response so no two responses have the same fingerprint.
  - moonlighter 10y ago
    user btown answered that elsewhere here in this thread: "https://github.com/technion/mod_randpad https://github.com/technion/mod_randpad (an Nginx module that injects padding as a comment into returned HTML documents) is likely the correct layer to add random padding; the performance hit would be negligible."
tyrust 10y ago
If this is the first (and only) time someone visited the domain around the time of a leak, it may be a little suspicious.
- UnoriginalGuy 10y ago
  Then use public WiFi.

deleted 10y ago

[deleted]

Gnewt 10y ago

If they can't see the contents, they also can't see the URL -- both are encrypted.

olivierlacan 10y ago

No, HTTPS URLs are not logged in plain text as they are in HTTP. So it does make an important difference. See: http://security.stackexchange.com/a/2916/50175 http://security.stackexchange.com/a/2916/50175

jvdh 10y ago
If you mean "logging" as in web server logs, then it completely depends on the configuration of the server and there is nothing the client can do about it.. If you mean "transferring over the network", then yes, HTTPS only shows the server you are connecting to, but not the specific URL. Then again, that can be deduced from the transfer sizes that are still shown.

mcherm 10y ago

Not true. HTTPS encrypts the URL as well as the content of the communication. Someone surveilling the conversation with the ability to observe all network traffic but without the ability to decrypt SSL traffic would be able to tell that the end user had viewed something at a particular website (technically, at a particular server), but would NOT be able to tell WHICH article was viewed.

detaro 10y ago
I wonder how much that actually gains for this specific case ("which article did IP $x view?"). With more effort, it should be fairly easy to match the traffic pattern to the article, e.g. by matching the size of subsequent requests for the images. But more complicated than a simple filter that just grabs all URLs from HTTP.
- ethbro 10y ago
  > With more effort That's the new key point for 2017 pro-privacy architectures. Proof of work surveillance doesn't scale because requiring it leverages the disparity between the total level of Internet traffic and intelligence agency resources. Kill the dragnets as step 1, then worry about step 2.
  - deathhand 10y ago
    It would be helpful to have a website to display a random image of differing sizes for every page load. This would prevent fingerprinting https.
    - pixl97 10y ago
      Um, I don't believe that would help. You either inline the images as data, or better, get rid of all images and have random length non-printing text to hide the real data. This kills caching and performance though.
      - 10y ago

jakelazaroff 10y ago

It's worse than just knowing the URL. HTTP pages can be altered without your knowledge by a malicious third party: http://security.stackexchange.com/a/72661 http://security.stackexchange.com/a/72661 So a surveillance agency could e.g. replace the URLs for the various organizations' leaks landing pages and Tor addresses with phishing pages, and anyone who used them would upload documents directly to the agency.