3 ms·

I’m the guy who said “law enforcement doesn’t seem to care about HTTPS, I wonder why.” 1. HTTPS relies heavily on DNS. It’s as secure as DNS is. Nuff said. 2.

I’m the guy who said “law enforcement doesn’t seem to care about HTTPS, I wonder why.” 1. HTTPS relies heavily on DNS. It’s as secure as DNS is. Nuff said. 2. As has been said, there’s law enforcement can get the logs. Not hard. 3. The way the web currently works strongly encourages users to wear a “name tag.” It’s hard to take that name tag off. HTTPS doesn’t help with that. HTTPS is very important, but has much narrower scope, and chaotic implementation, than most people realize.

woodruffw 5y ago
> 1. HTTPS relies heavily on DNS. It’s as secure as DNS is. Nuff said. I don't think this is true: HTTPS (and TLS >= 1.3) provide a suite of protections that mostly address perceived weaknesses in DNS (ECH, ESNI, CT logging, HSTS, etc.). As for DNS itself: DoH and DoT is widely available, and my understanding is that all major browsers currently support one or the other. I've been using outbound DoH for at least two years at this point via Pi-hole. I interpreted "law enforcement doesn't seem to care [...]" as a claim that domestic LEO has meaningfully broken HTTPS on general traffic, which I don't believe is the case. But if you meant that they don't care because they have legal access mechanisms that already suit their purposes, then I agree.