3 ms·
But it hides the HTTP request itself - Sourceforge hosts thousands of different projects, if served over HTTPS it'd be considerably harder to tell which downloa
by JosephRedfern 12y ago
But it hides the HTTP request itself - Sourceforge hosts thousands of different projects, if served over HTTPS it'd be considerably harder to tell which download had been requested.
- dhbanes 12y agoI'm pretty sure an HTTPS GET request to http[s]://iweb.dl.sourceforge.net/project/handbrake/0.10.0/HandBrake-0.10.0-MacOSX.6_GUI_x86_64.dmg would be pretty easy to identify as a HandBrake download. The resource requested is not hidden.
- quesera 12y ago> The resource requested is not hidden. Your GET request, and the server's reply, is encrypted. The hostname of your request might leak in SNI, or if your DNS lookup was insecure. It is also plausible that an eavesdropper could make a solid guess as to what you downloaded by counting bytes, but that's obviously not worth much.
- icebraining 12y agoThe hostname of your request might leak in SNI, or if your DNS lookup was insecure. You don't need a DNS leak; if you aren't using SNI, the server(s) replying on that IP can only serve a single cert, so the snooper can usually find out the hostname by simply connecting to it and seeing what it gets. The exception is if the site is behind something like Cloudflare, which stuff dozens or hundreds of hostnames in a single cert.
- tomcorrigan 12y agoYou clearly don't understand how HTTPS works.
- btgeekboy 12y agoHTTPS works by first creating a TLS connection, then sending the HTTP request and response through it. Thus, the request (including the path) is encrypted.
- omnibrain 12y agoThat's a common misconception and it's quite easy to fall for. Please read http://www.moserware.com/2009/06/first-few-milliseconds-of-https.html http://www.moserware.com/2009/06/first-few-milliseconds-of-h...
- dhbanes 12y agoGood read, thanks.
- dhbanes 12y agoThanks for the clarification everyone.