4 ms·
Fetching a weather forecast reveals that I was in a certain location. Depending on circumstances, that could easily be incriminating evidence. Yes, Dark Sky sho
by earthboundkid 6y ago
Fetching a weather forecast reveals that I was in a certain location. Depending on circumstances, that could easily be incriminating evidence. Yes, Dark Sky should be HTTPS by default.
- cguess 6y agoAlso could imply where you're going to. Looking up the weather in London (if I don't normally) almost certainly entails a trip. This is pretty deep down the threat modeling hole though, and no, normal people don't need to care about this.
- bowmessage 6y agoNormal people don't even know what HTTPS means!
- kstrauser 6y agoThat's why we like to use it everywhere: to protect the people who didn't know they needed protection.
- bowmessage 6y agoYeah, +1, what I meant to convey too :)
- SilasX 6y agoWhat, you don't bombard weather APIs with dummy requests about random cities so as to obscure where you might be going?
- brewdad 6y agoWhen baseball season is actually occurring I will sometimes look up weather in a half dozen cities around the country to get an idea of which games might get rained out. Not exactly the same thing but I'm not actually traveling to any of them.
- colonwqbang 6y agoHTTPS does not encrypt the source and dest IP of your packets, right? So HTTPS can't hide who you are and what APIs you're talking to.
- egyptiankarim 6y agoCorrect. TLS-wrapped protocols don't seek to offer anonymity of the source and destination. They're designed to protect the confidentiality and integrity of data in transit. The best tools we have for anonymity are things like onion routing.
- earthboundkid 6y agoThe IP of my phone connecting to the IP of Dark Sky is much less precise than the request for GPS coordinates to get block level weather data (the Dark Sky website uses 12.345 digits, so is accurate to block level).
- deleted 6y ago[deleted]
- Silhouette 6y agoThis is where the arguments start to get a bit silly. If the authorities are trying hard enough to find you and your phone is on, the network it is attached to can probably locate you very accurately under most conditions already. HTTPS is useful, and it should normally be the default for web traffic potentially crossing any untrusted network, but let's keep it in perspective. It's an application layer protocol. It can't protect you against attacks at lower layers.
- purerandomness 6y agoIt's not authorities, anyone setting up a router can peek into this information, and more importantly, tamper with it. Remember Upside-Down-Ternet? [1] [1] http://www.ex-parrot.com/pete/upside-down-ternet.html http://www.ex-parrot.com/pete/upside-down-ternet.html