4 ms·
Even with HTTPS, it's easy enough to figure out which package is being downloaded based on the download size, as explained in TFA. Every time this comes up, it
by jlarocco 8y ago
Even with HTTPS, it's easy enough to figure out which package is being downloaded based on the download size, as explained in TFA.
Every time this comes up, it's always the same handful of incorrect arguments made in favor of HTTPS.
The cargo-cult mentality that HTTPS == security really does more damage than it does good.
- zaptheimpaler 8y agoI mean deducing the package from download size is way harder than just seeing the name in the open.. security is rarely perfect and more like an arms race, making things more difficult is a big deal. This kind of "you can hack Y too" argument doesn't make any sense if its way harder to hack Y than X.
- wallunit 8y agoIs that even true? In practice rather than downloading a single package you'd download/update a bunch of packages over the same connection, and an attacker would only see the accumulated size, right?
- pvorb 8y agoI'm not sure how APT handles connections, but with a typical browser connections will be reused if requests are made shortly after another. That doesn't mean it's impossible to determine what packages you downloaded. But it will be more effort to do so.
- jlarocco 8y agoYou can see when you run "apt-get install ..." or "apt-get upgrade" that it opens multiple connections to download packages... And the Debian contributor who wrote TFA says it's possible, and I'm sure he knows a lot more about it than I do.
- dcbadacd 8y agoLess with HTTP2/TLSv1.3, endpoints are also hard to detect with ESNI.
- AstralStorm 8y agoNo they aren't. HTTPS fingerprinting is easy. It's been done by lcamtuf years ago and it's available as a layer 7 filter in Linux... TLS adds more information because it prevents proxies and has specific server implementations.