4 ms·
Aren’t you assuming that users are only navigating to HTTPS sites and entering information? That’s unfortunately not the case. That also ignores the fact that h
by scrose 6y ago
Aren’t you assuming that users are only navigating to HTTPS sites and entering information? That’s unfortunately not the case. That also ignores the fact that having information about general activity can in itself be a privacy concern, whether or not that information is readable.
- bawolff 6y agoI am assuming that users go to their bank website by typing it into google and then clicking on their bank as a result. Google is HSTS. The bank may or may not be (what a sad state of affairs, but i digress) but the link from google will at least be https. What websites do you have in mind that are not https and that average users enter personal information that could lead to identity theft on? > having information about general activity can in itself be a privacy concern, whether or not that information is readable. It definitely can be in some threat models. In the context of average user being the target of drive-by identity theft, i struggle to see a realistic threat model for traffic-analysis of encrypted network traffic.