4 ms·
If you could avoid certain pipes it could only help security. Even with the security of TLS, that doesn't prevent state-level actors from observing meta data wi
by smokeyj 8y ago
If you could avoid certain pipes it could only help security. Even with the security of TLS, that doesn't prevent state-level actors from observing meta data with the advantage of internet-wide timing data, which could be useful for say, analyzing TOR traffic.
Not a crypto expert but doesn't trusting TLS imply trusting root certs on your PC? Regardless, the Snowden leaks showed that internet traffic can be modified to contain harmful payloads for targeted individuals. Even if only susceptible over non-TLS it still represents a non-zero percentage of internet traffic.
- dev_dull 8y agoWho will you even "avoid"? It's in the interest of every major country to do surveillance.
- TaylorAlexander 8y agoIt may seem equally compelling to all countries, but in practice some countries put huge resources in to gathering everything, and some don’t. Avoiding the ones that in practice collect everything in favor of ones that in practice don’t would increase security. Separately, we should stay mindful of who is doing this collection, and simultaneously take additional measures to secure our communications.
- semi-extrinsic 8y agoI'm trying to come up with a list of countries that don't collect basically all data, and I'm coming up short. Do you have any suggestions?
- r1ch 8y agoTrusting root certs is a lot less worrying with the advent of certificate transparency. It's now very noisy if a CA issues a cert for something like google.com, and smaller sites can get notifications about cert issuances for their domains from various free alerting services.