3 ms·
I'm one of the Disconnect devs and these definitely aren't stupid questions: 1. Unlike that other "privacy" cough extension, Disconnect doesn't send any data (
by byoogle 13y ago
I'm one of the Disconnect devs and these definitely aren't stupid questions:
1. Unlike that other "privacy" cough extension, Disconnect doesn't send any data (user or otherwise) to Disconnect servers. In other words, Disconnect doesn't output user data that can be intercepted by a MITM attack. Disconnect does grab a config file on startup (https://disconnect.me/help#syncing https://disconnect.me/help#syncing), but unlike in the Amazon case, the file is both transferred over HTTPS and encrypted (with the Stanford Javascript Crypto Library). Also unlike in the Amazon case, the file has a limited functional scope (which third-party sites to block) so is less susceptible to being rewritten in an abusive way.
2. One of our other Chrome extensions, Collusion for Chrome, will actually show you requests that are coming from other extensions. The more technical approach, which isn't that hard and I'd like to see more people try, is to run a packet sniffer (recommended: http://www.wireshark.org/ http://www.wireshark.org/) or proxy server (recommended: http://www.charlesproxy.com/ http://www.charlesproxy.com/).
- astupidquestion 13y agoThank you. Can you recommend any tutorials for Charles Proxy or Wireshark? They are more technical than I understand.
- byoogle 13y agoI don't know of any, but I imagine there are a bunch on YouTube and so forth. I will say that of the two, Charles is the easier to use and I don't think too hard to figure out without any docs.
- quotemstr 13y ago> encrypted (with the Stanford Javascript Crypto Library) TLS already encrypts. What threat model prompted your decision to use JavaScript cryptography?
- byoogle 13y agoThis: http://www.thoughtcrime.org/blog/ssl-and-the-future-of-authenticity/ http://www.thoughtcrime.org/blog/ssl-and-the-future-of-authe....