3 ms·
That's why I mention sslstrip (check out the presentation - it's scary) and overall lack of SSL on the internet. To provide some anecdata, my browser window cu
by csandreasen 12y ago
That's why I mention sslstrip (check out the presentation - it's scary) and overall lack of SSL on the internet. To provide some anecdata, my browser window currently has 8 tabs open right now.
Those that support HTTPS: news.ycombinator.com; twitter.com; www.torproject.org
Those that don't:
cryptome.org (!); zzaper.co.uk (the Vim tips article from a few days ago); forbes.com; vimeo.com; nytimes.com
End-to-end encryption would be great, but the internet at large just isn't there yet in terms of both HTTPS support on most sites and safeguards against SSL tampering.
- hackcasual 12y agoI will say safeguards against tampering are getting better for newer browsers. I'm working on a software stack for PirateBox type systems but focused on security, so I get a pretty good glimpse at how a lot of sites handle incorrect certs, since it's an internetless portal and redirects everything to its hosted SSL page. Both gmail and hackernews will refuse to load at all, as they properly support HSTS. Well gmail "cheats" and is hard coded in chrome.
- frandroid 12y agoSo how does Gmail do it with other browsers?
- hackcasual 12y agohttp://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security#Browser_support http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security#...
- glomph 12y agoWhat is the use to an exit node in knowing that someone is reading cryptome zzaper forbes vimeo and nytimes? Presumably you are not going to transfer any identifying info to these sites.
- discreditable 12y agoTracking cookies used across various services are known to be used by the NSA to identify users.
- FedRegister 12y agoIf you're using the same browser for Tor and non-Tor traffic (and therefore the same cookies) then You Are Doing It Wrong.
- id 12y agoThat's why the Tor Browser clears cookies on close. But you are free to disable them entirely.