3 ms·
> As a client I don't get to choose how the servers interact with are configured. Clients are the ones that cause the privacy leak, not servers. > The issue i
by mholt 5y ago
> As a client I don't get to choose how the servers interact with are configured.
Clients are the ones that cause the privacy leak, not servers.
> The issue is the absolute fantasy that HTTPS makes your connection secure.
Oh, OK.
> Are you really telling me I have to implement every piece of software I want to run myself from scratch, write custom firmware for my processor, for my router, then sit down and create a custom ROM with a custom operating system for my phone?
If you don't trust them, then yes. Nothing new here though.
- marginalia_nu 5y ago> Clients are the ones that cause the privacy leak, not servers. Regardless of where the leak is, this is not a problem that exists in HTTP. You could not just go to a central server and gather a log of some NN% of the HTTP connections being made. No, DNS is not analogous. You can choose your DNS server, you can even run your own. > If you don't trust them, then yes. Nothing new here though. What's new is that it's become a lot harder to examine the information my software is sending to servers on the Internet. If they all talked HTTP, it would be trivial for me to intercept and examine. You can do that with HTTPS, sometimes, but it's a lot harder and relies on the software obeying OS proxy settings.
- waste_monk 5y agoYou probably want a layer 7 firewall that only allows HTTPS traffic to/from the internet to your terminating proxy. Stuff that doesn't obey the system proxy (or a few of the other pitfalls e.g. HPKP) will break, but at least you'd be aware of what's not allowing itself to be intercepted.