3 ms·

That's true. If you're talking about your ISP sniffing your traffic, HTTPS is a win. But since the author was talking about using Tor, I figured he was focusing

by apeace 9y ago

That's true. If you're talking about your ISP sniffing your traffic, HTTPS is a win. But since the author was talking about using Tor, I figured he was focusing on fingerprinting by the websites themselves, where HTTPS is easier for them to fingerprint than HTTP.

CiPHPerCoder 9y ago
I don't doubt that HTTPS fingerprinting can be useful, but you can see the contents of their communications with HTTP. That seems much more useful for getting intelligence about Tor users.
acdha 9y ago
> fingerprinting by the websites themselves, where HTTPS is easier for them to fingerprint than HTTP. Could you explain your reasoning on that? If they're using the Tor browser every user is going to be very similar on crypto suites, user-agent, etc. — it's a rebadged Firefox distributable so it's going to be using their HTTPS implementation and you won't even get the OS version variations unless someone at the Tor project massively screws up. The bigger problem is that if you are being targeted by the website, there are far more interesting attacks they can try – convince the user to turn on JavaScript and do all of that profiling for WebGL/canvas rendering, local fonts, network resource timing to look for cached content from other sites, etc.
- apeace 9y ago
  Yes, great point. But I said _easier_, not _easy_. Using HTTPS, a user may have a more outdated version of the Tor browser with different cipher suites than everyone else. Using plain HTTP, that can't happen. > unless someone at the Tor project massively screws up And that is what the author of the article is claiming. My comments here aren't in agreement with the author of the article, and I'm not claiming "HTTPS is bad" or anything like that. It's simply a categorical fact that HTTPS has more vectors to be fingerprinted than HTTP. But of course, as you mentioned, features enabled by Javascript are the bigger problem, which is why users who wish to be anonymous should completely disable it!
  - acdha 9y ago
    Adding HTTPS plausibly adds a single low-cardinality signal but it removes a ton of other ones for network-level observers. When it comes to hostile site owners, realistically you're screwed but from a privacy perspective it's a question of whether you're one of the small percentage of users who have a) failed to install updates and b) disabled JavaScript. That's a pretty small percentage of users for whom HTTPS isn't an across-the-board win for privacy.

by apeace 9y ago

CiPHPerCoder 9y ago

I don't doubt that HTTPS fingerprinting can be useful, but you can see the contents of their communications with HTTP. That seems much more useful for getting intelligence about Tor users.

acdha 9y ago

> fingerprinting by the websites themselves, where HTTPS is easier for them to fingerprint than HTTP. Could you explain your reasoning on that? If they're using the Tor browser every user is going to be very similar on crypto suites, user-agent, etc. — it's a rebadged Firefox distributable so it's going to be using their HTTPS implementation and you won't even get the OS version variations unless someone at the Tor project massively screws up. The bigger problem is that if you are being targeted by the website, there are far more interesting attacks they can try – convince the user to turn on JavaScript and do all of that profiling for WebGL/canvas rendering, local fonts, network resource timing to look for cached content from other sites, etc.

apeace 9y ago
Yes, great point. But I said _easier_, not _easy_. Using HTTPS, a user may have a more outdated version of the Tor browser with different cipher suites than everyone else. Using plain HTTP, that can't happen. > unless someone at the Tor project massively screws up And that is what the author of the article is claiming. My comments here aren't in agreement with the author of the article, and I'm not claiming "HTTPS is bad" or anything like that. It's simply a categorical fact that HTTPS has more vectors to be fingerprinted than HTTP. But of course, as you mentioned, features enabled by Javascript are the bigger problem, which is why users who wish to be anonymous should completely disable it!
- acdha 9y ago
  Adding HTTPS plausibly adds a single low-cardinality signal but it removes a ton of other ones for network-level observers. When it comes to hostile site owners, realistically you're screwed but from a privacy perspective it's a question of whether you're one of the small percentage of users who have a) failed to install updates and b) disabled JavaScript. That's a pretty small percentage of users for whom HTTPS isn't an across-the-board win for privacy.