3 ms·

if you visit wikipedia.org/whistleblowing, what exactly value is there from hiding content but force revealing you visited it, making sure it can't be retrieved

if you visit wikipedia.org/whistleblowing, what exactly value is there from hiding content but force revealing you visited it, making sure it can't be retrieved from a cache within your organization/school network? and doesn't pervasive tls termination mean that Cloudflare/etc sees plaintext anyway? do we really believe that palantir isn't tapping into that? i can imagine just a few scenarios where hiding content on the web actually achieves something. mainly stuff like webmail, web chats, banking.

nl 5d ago
> if you visit wikipedia.org/whistleblowing Just visiting, sure but if you edit it to leak a secret the protection is everything. Say you are on your school network and leak something damaging about the school on Wikipedia. Prior to Wikpedia switching to HTTPS, both the school and any intermediate network could see - you visited Wikipedia - you edited Wikipedia - what you wrote on Wikipedia After HTTPS, your school could see - you visited Wikipedia That's strictly better in every way.
- layer8 5d ago
  > if you edit it to leak a secret the protection is everything. It’s really not, because knowing when you edited it is already enough, given that there’s a timestamped edit history. And the size and shape of your request payloads will show that you edited it, not merely performed GET requests.