4 ms·

Yes, exactly. But why? What's the agenda? Why now? It's not like Amazon.com was broken between 1996 and 2016. There is a push to HTTPS at all costs, even if thi

by frik 10y ago

Yes, exactly. But why? What's the agenda? Why now? It's not like Amazon.com was broken between 1996 and 2016. There is a push to HTTPS at all costs, even if things (ad networks, devs, software) is not ready and is there even a need for 100% TLS? That an open source browser is engaged in such initiative is not good. With HTTP you can be anonymous, and most website visits aren't mission critical things. With HTTPS your traffic is quite unique and the players with big money have the resources anyway, there TLS is no big thing as we learned in the last few years. So which Think-tank or what ever is behind this initiative?

drchickensalad 10y ago
Even if it's not a mission critical web request, isp's injecting content into your http pages is unacceptable. Even if the government could brute force or fingerprint one of your TLS sessions, they can't do it for everyone for every site. Just because Amazon wasn't broken doesn't mean we can't improve it. Also your comment about a think tank coming up with this idea is an odd insult, given how broadly you can empirically see people support this.
- jsudhams 10y ago
  Hmmm but i am pretty sure ISP and Ad Agents(Google etc..) will figure a way to inject content.
  - orf 10y ago
    Well... They won't be able to. If they can figure out a way it means they have broken the underlying encryption, so that gets fixed.
bluejekyll 10y ago
You believe TLS makes it easier to track you? Is this based on some odd notion of ClientAuth? This is a great opportunity to get people to use TLS across the board. The carrot is HTTP/2.
detaro 10y ago
> With HTTPS your traffic is quite unique What's more unique about HTTPS traffic than HTTP traffic?
- oconnor663 10y ago
  Your supported ciphers contribute to your browser fingerprint maybe?
  - infogulch 10y ago
    I cannot imagine that the supported ciphers could be more identifying than your user agent, all cookies, all headers, query string, and request body.
MichaelGG 10y ago
>there TLS is no big thing as we learned in the last few years Citation? We've learned what has always thought to have been true: Encryption works very well and intel collectors need to resort to attacking other aspects. TLS has had its share of flaws but it's still very much a "big thing" to defeat.

by frik 10y ago

drchickensalad 10y ago

Even if it's not a mission critical web request, isp's injecting content into your http pages is unacceptable. Even if the government could brute force or fingerprint one of your TLS sessions, they can't do it for everyone for every site. Just because Amazon wasn't broken doesn't mean we can't improve it. Also your comment about a think tank coming up with this idea is an odd insult, given how broadly you can empirically see people support this.

jsudhams 10y ago
Hmmm but i am pretty sure ISP and Ad Agents(Google etc..) will figure a way to inject content.
- orf 10y ago
  Well... They won't be able to. If they can figure out a way it means they have broken the underlying encryption, so that gets fixed.

bluejekyll 10y ago

You believe TLS makes it easier to track you? Is this based on some odd notion of ClientAuth? This is a great opportunity to get people to use TLS across the board. The carrot is HTTP/2.

detaro 10y ago

> With HTTPS your traffic is quite unique What's more unique about HTTPS traffic than HTTP traffic?

oconnor663 10y ago
Your supported ciphers contribute to your browser fingerprint maybe?
- infogulch 10y ago
  I cannot imagine that the supported ciphers could be more identifying than your user agent, all cookies, all headers, query string, and request body.

MichaelGG 10y ago

>there TLS is no big thing as we learned in the last few years Citation? We've learned what has always thought to have been true: Encryption works very well and intel collectors need to resort to attacking other aspects. TLS has had its share of flaws but it's still very much a "big thing" to defeat.