4 ms·

Honest question: what security would be gained by encrypting the contents of a static web page. The specific urls visited (but not the domain itself)?

soulofmischief 4y ago
The data can be tampered with in transit.
isbvhodnvemrwvn 4y ago
You can inject dynamic content into a static site in transit.
jlokier 4y ago
A few years ago someone reviewing a public page I was serving over HTTP came and asked "It is breaking the page on my browser, producing a weird console error, and I don't like the look of some of the things the JavaScript code does." This person's review affected whether we'd use my work or not. I found the criticism puzzling, because I couldn't explain the condone error, and did nothing bad in JavaScript. It took several days before I asked them to show me the page in their browser, and then to show me which bit of JavaScript was bothering them. I didn't recognise the code, and wondered what I had screwed up with my build scripts. But when I looked at the page with my browser we found the source of errors: The ISP used by the institution we worked at was injecting its own code into every HTML front page for tracking or some other unclear purposes. It had been doing this for all devices connected to the network and nobody knew. That was our motivation to switch all our static pages to HTTPS asap, and towards an HTTP client relay VPN at the router, because other sites accessd by users inside the institution should not be subjected to ISP code injection either.
- arghnoname 4y ago
  Wow, that's pretty crazy. I thought hijacking failed domain resolution queries was bad. Thanks, under this threat model (which I hadn't considered), ubiquitous https makes sense.
em-bee 4y ago
depends on the site. you generally get the privacy from others knowing which pages on a site you read. if the whole site is just like that of my company which describes my business and my projects then that's no win for privacy because they can follow the ip and assume you read all of that. however if the site is a static copy of wikipedia, they can infer a lot from knowing which pages you actually looked at.

soulofmischief 4y ago

The data can be tampered with in transit.

isbvhodnvemrwvn 4y ago

You can inject dynamic content into a static site in transit.

jlokier 4y ago

A few years ago someone reviewing a public page I was serving over HTTP came and asked "It is breaking the page on my browser, producing a weird console error, and I don't like the look of some of the things the JavaScript code does." This person's review affected whether we'd use my work or not. I found the criticism puzzling, because I couldn't explain the condone error, and did nothing bad in JavaScript. It took several days before I asked them to show me the page in their browser, and then to show me which bit of JavaScript was bothering them. I didn't recognise the code, and wondered what I had screwed up with my build scripts. But when I looked at the page with my browser we found the source of errors: The ISP used by the institution we worked at was injecting its own code into every HTML front page for tracking or some other unclear purposes. It had been doing this for all devices connected to the network and nobody knew. That was our motivation to switch all our static pages to HTTPS asap, and towards an HTTP client relay VPN at the router, because other sites accessd by users inside the institution should not be subjected to ISP code injection either.

arghnoname 4y ago
Wow, that's pretty crazy. I thought hijacking failed domain resolution queries was bad. Thanks, under this threat model (which I hadn't considered), ubiquitous https makes sense.

em-bee 4y ago

depends on the site. you generally get the privacy from others knowing which pages on a site you read. if the whole site is just like that of my company which describes my business and my projects then that's no win for privacy because they can follow the ip and assume you read all of that. however if the site is a static copy of wikipedia, they can infer a lot from knowing which pages you actually looked at.