6 ms·
It’s not mostly moot. Most web sites do not use CDNs. And to the extent that websites do use CDNs, then your isp is no longer your concern for privacy, the CDN
by CyberRabbi 6y ago
It’s not mostly moot. Most web sites do not use CDNs.
And to the extent that websites do use CDNs, then your isp is no longer your concern for privacy, the CDN is.
- captn3m0 6y agoThere’s also SNI leaks (for now).
- zinekeller 6y agoValid point, kind of hard to solve actually because at some point the server needs to know who are you talking to. Limiting it is the current target for proposed standards, but alas it is an open problem for now.
- zinekeller 6y ago> Most web sites do not use CDNs. And unless your typical user is actually a developer, you are out of the park. I forgot about SNI leakage. That's a valid point. There are CDNs you wouldn't have thought to be actually CDNs. Most Wordpress sites (outside of WordPress.com) are actually being run on WordPress.com infrastructure, and even if not they are often shared installations such as from Namecheap or GoDaddy, which shares the same addresses. Not to mention alternative building sites like Wix, Squarespace, Carrd, or even GitHub (surprise!). Or independent shopping sites, most are actually just Etsy (operates on etsy.com) or Shopify (you can use a domain if you want to). And that's scratching the surface of how changed web is now. You have underestimated how centralised is the web now. This can be bad or good (despite comments from second-hand critics, the French Minitel was amazing for its time, and on the flipside Facebook).
- CyberRabbi 6y agoTo the extent that the web is centralized my second point holds: TLS does nothing to protect you from the platform owners and you’re not much worse off going plaintext.