3 ms·
Even for wikipedia there are privacy implications of third parties knowing which page you are visiting and integrity concerns in places countries that want cen
by rythie 12y ago
Even for wikipedia there are privacy implications of third parties knowing which page you are visiting and integrity concerns in places countries that want censor certain topics (e.g. China).
I wrote about this a few months ago:
https://rythie.com/blog/blog/2014/03/05/should-all-sites-use-https/ https://rythie.com/blog/blog/2014/03/05/should-all-sites-use...
- Someone1234 12y agoThat's a nice concept, but even with HTTPS the GET string is often leaked (e.g. referrer strings, tracking URLs (like Google's prior to this)). It is technically encrypted in HTTPS traffic but it isn't treated with very much respect so if you actually have access to all of the HTTP and DNS traffic surrounding a request you can often recover pages viewed. Additionally, in a lot of these countries computers come pre-installed with a government root CA which they can use to impersonate sites like Wikipedia (although the USG does this too!).
- rythie 12y agoI note that the HTTP spec covers the leaking of referers: "A user agent MUST NOT send a Referer header field in an unsecured HTTP request if the referring page was received with a secure protocol." http://tools.ietf.org/html/rfc7231#section-5.5.2 http://tools.ietf.org/html/rfc7231#section-5.5.2 and that's how browsers implement it too. DNS doesn't give the page you were on. Whilst some systems might have a government root CA on it, it's still quite possible to remove that - it's pratically impossible to remove ISP level monitoring.
- SnacksOnAPlane 12y agoHTTPS doesn't hide which page you're visiting, does it?
- rythie 12y agoIt does hide the page you're on and all the headers & content too.