4 ms·

There's a difference between being the middle man so you can minify for the user, and logging all that goes through you. Just because we can't detect that chang

There's a difference between being the middle man so you can minify for the user, and logging all that goes through you. Just because we can't detect that change anyone who offers that service is a government lackey? I like Opera Mini, which is just like this. But I hope my bank blocks it.

modeless 14y ago
Certainly they don't log "all that goes through" them; that would be stupid and not really practical. However, nothing is stopping them from logging all data from specific persons of interest, or using MITM attacks to discover passwords, etc. Law enforcement, spy agencies, and others would be very interested in such a capability.
yk 14y ago
Of course there is a difference between just Mitm for compression and outright eavesdropping. But with this point of attack a government can simply walk to Nokia with a court order, and Nokia will comply, most likely without much of a fight. Or a little bit more abstract, the technical security is broken and the user relies on social norms for his privacy. The same social norms which forbid my ISP to sniff my non SSL traffic.
- darkarmani 14y ago
  > But with this point of attack a government can simply walk to Nokia with a court order, and Nokia will comply, most likely without much of a fight. Nokia might not even require a court order to let the government have access to your data. A court order is only to force Nokia to give access.
im3w1l 14y ago
>There's a difference between being the middle man so you can minify for the user, and logging all that goes through you How do you cache without storing?
- raylu 14y ago
  You can minify without caching.
zurn 14y ago
The whole point of HTTPS and end-to-end crypto in general is that you know the communication is private between just you and your counterparty. If you subvert HTTPS so that there are middle men, that is broken.

modeless 14y ago

Certainly they don't log "all that goes through" them; that would be stupid and not really practical. However, nothing is stopping them from logging all data from specific persons of interest, or using MITM attacks to discover passwords, etc. Law enforcement, spy agencies, and others would be very interested in such a capability.

yk 14y ago

Of course there is a difference between just Mitm for compression and outright eavesdropping. But with this point of attack a government can simply walk to Nokia with a court order, and Nokia will comply, most likely without much of a fight. Or a little bit more abstract, the technical security is broken and the user relies on social norms for his privacy. The same social norms which forbid my ISP to sniff my non SSL traffic.

darkarmani 14y ago
> But with this point of attack a government can simply walk to Nokia with a court order, and Nokia will comply, most likely without much of a fight. Nokia might not even require a court order to let the government have access to your data. A court order is only to force Nokia to give access.

im3w1l 14y ago

>There's a difference between being the middle man so you can minify for the user, and logging all that goes through you How do you cache without storing?

raylu 14y ago
You can minify without caching.

zurn 14y ago

The whole point of HTTPS and end-to-end crypto in general is that you know the communication is private between just you and your counterparty. If you subvert HTTPS so that there are middle men, that is broken.