4 ms·
Not anymore because of HTTPS
by ronsor 7y ago
Not anymore because of HTTPS
- dotancohen 7y agoHTTPS encrypts the contents of the request. The things requested still happen in plain text.
- tialaramex 7y agoMost of the request is encrypted. Suppose you type https://foo.example.com/bar?baz#quux https://foo.example.com/bar?baz#quux into your browser Most TLS (TLS up to 1.2) will tell anybody who is watching that you visited foo.example.com including the SNI foo.example.com your browser sent to tell the server which name it was looking for and the certificate the server provided to prove it is really foo.example.com. But it will encrypt bar and baz and quux isn't sent over the wire it's just used internally by the browser and any Javascript. That's the difference between "dotancohen looked at webMD" and "dotancohen looked at this article about sexually transmitted infections in men who have sex with men". In TLS 1.3 the certificate is encrypted, a snooper can still see you asked for foo.example.com but not whether this server in fact presented a certificate for that name. eSNI (currently under active development as an addition to TLS 1.3) encrypts that part where your browser asks for foo.example.com, since your browser also did a DNS lookup for foo.example.com we need to encrypt that too for it is make any real difference which is being done under DPRIVE.
- dotancohen 7y agoThank you. I was simplifying, but in fact DPRIVE is new to me.
- matthewdgreen 7y agoI think you're being overly optimistic. HTTPS still reveals domain names in many cases, traffic type, probably down-to-the-minute details of app usage. And this is leaving aside a bunch of (still potentially) unencrypted HTTP nonsense like advertising traffic, which -- ugh -- may contain all sorts of identifiers jammed into HTTP GET requests.
- DaniloDias 7y agoHe is not being overly optimistic. The carriers are not executing well on the concepts you describe, despite the feasibility of what you are proposing. Https everywhere is breaking things for the carriers. Tracking flows and reversing them for all customers is a non-trivial state management and storage problem.
- matthewdgreen 7y agoBut it's a problem they're clearly working on. And as long as these compromise threats are not perfectly dealt with, customers should very much be concerned.
- DaniloDias 7y agoGoogle is by far the bigger threat.
- LinuxBender 7y agoAT&T dealt with that by acquiring CarrierIQ. The product doesn't even have a public name any more AFAIK.