3 ms·
> If you're not doing anything requiring security, you don't need HTTPS, IMHO. I disagree, for a lot of reasons. For one thing, I don't want some random WI-FI
by cortesoft 4y ago
> If you're not doing anything requiring security, you don't need HTTPS, IMHO.
I disagree, for a lot of reasons. For one thing, I don't want some random WI-FI to know every page I visit, even insecure pages.
I also don't want to leak any information about my browsing habits. Using https everywhere limits the information you leak about how much of your traffic is sensitive.
- bayindirh 4y agoUnless you use DNS over HTTPS, all the effort there is moot. Even then, a flow server can trace all the point to point IP traffic passing over it. Yes, it limits the obtained data a lot (no hostnames to begin with), but a proper traffic analyzer is rarely blinded completely by HTTPS.
- cortesoft 4y agoThey would know the IP address and host name from SNI, but they wouldn't know which articles on the blog I read.
- deleted 4y ago[deleted]
- josephcsible 4y agoAnd if you're using TLS ECH, then they wouldn't even know the host name.
- 1vuio0pswjnm7 4y agoThe website operator has to use it, too. Many HTTP servers still do not support TLS1.3 let alone ECH (Draft 13). ECH is still experimental. Cloudflare disabled their ESNI trial a while back (ESNI worked great for me outside the browser), so unless they have now got ECH working (I still have not seen any announcement), currently there are even fewer sites offering encrypted SNI. You could probably count them on one hand. And Firefox (nightly), Chromium (105+) and Brave (nightly) are probably the only browsers that would support ECH and it is not enabled by default. I would be pleased to learn I am wrong here, because I would love to again start using sites that do not return requested pages unless a servername is sent.
- cma 4y agoComcast injects data into plain http pages, altering them when they see fit (they put in a datacap warning into the text of the page).
- gkbrk 4y agoIf Comcast is doing something wrong, why does everyone else need to do something about it? If Comcast stops routing packets on port 433, should everyone else stop using it as well?
- Gigachad 4y agoISPs are evil and untrusted. That’s just a fact. The solution is to not allow them to see or modify anything.
- stiray 4y agoOther IT corporations are also evil and untrusted. But no one cares if they can look into all your mails and documents (Microsoft, Google), track you all over the web, see where you are going, which flight you are taking,... The important is that ISPs are evil and untrusted. facepalm
- Gigachad 4y agoISPs are the most blatantly scummy of the lot. They log everything, usually by government requirements, sell it to anyone, give it to the government without a warrant, inject adverts and js in to unprotected requests, and all kinds of malicious things. They are easily eliminated from the picture. One less party with access to your data the better. There is really _no_ good argument for not having HTTPS on any site unless its some very rare case like an intranet site.
- staticassertion 4y ago> But no one cares if they can look into all your mails and documents (Microsoft, Google), track you all over the web, see where you are going, which flight you are taking,... I don't think I go a single day without reading posts complaining about exactly that, so obviously people do care.
- davidro80 4y ago
- denkmoon 4y agoDoH is bad use DoT instead.
- josephcsible 4y agoThis couldn't be further from the truth. DoT is easy to block, so anyone who wants to censor or surveil you will just do so. You should always use DoH instead, since it's way more resistant to blocking.
- denkmoon 4y agoCan't wait til google owns your DNS and you can't do shit about it
- josephcsible 4y agoHow does DoH make DNS any more centralized than DoT does?
- denkmoon 4y agoWhen Google embed their DNS and their certificate into every Google product you have to use, you can't effectively block it.
- josephcsible 4y agoIf your goal isn't to censor or surveil other people, then why do you need to block Google's DNS rather than just not using it yourself?
- denkmoon 4y agoChromecast will use Google DNS and there is nothing you can do about it on the device. Guarantee this will happen to Chrome eventually.
- 4y ago
- Gigachad 4y agoDNS over HTTPS is default on some browsers now. Firefox does it iirc.
- slooonz 4y agoHTTPs not completely blinding traffic analyzer doesn’t make the partial blinding useless.
- tsimionescu 4y agoKnowing that I'm watching YouTube is one thing, knowing what YouTube video I'm watching is a completely different problem. Edit also: even with DNS over HTTPS, a lot of the Internet uses SNI for TLS, so anyone snooping can anyway see what hostname you're visiting (not to mention, IPs are not significantly more private than host names, and those will always be public unless you're using ToR or something similar).
- denton-scratch 4y ago> Unless you use DNS over HTTPS It really isn't hard to set up an unbound resolver.
- verisimilitudes 4y agoThat's called a personal problem. It's not the responsibilty of a website owner to make his website constantly rot for the sake of strangers.
- deleted 4y ago[deleted]
- Handytinge 4y agoDon't use random Wi-Fi then? Or if you do, have an always on routed VPN? You're leaking data all over the place, placing the burden on the website owner is silly.