4 ms·
>...given SSL.... Only the URL's would be visible... Unless I'm mistaken, TLS/SSL encrypts the URL. Only the domain name and IP address of the server would be
by nokcha 11y ago
>...given SSL.... Only the URL's would be visible...
Unless I'm mistaken, TLS/SSL encrypts the URL. Only the domain name and IP address of the server would be visible to a snooper.
- comboy 11y agoRandom thought (not my field), length is still correlated right? Since these are public pages, could you infer with good probability url visited based on the transferred data size? (yeah gzip and stuff but you can compare gzipped) If yes then especially for an active (participating) user I suppose you can take some good guesses.
- iancarroll 11y agoYes, you could. It'd be a gamble but it's possible. This is why you should consider implementing length hiding[1], either via a header or HTML comment. [1] https://github.com/nulab/nginx-length-hiding-filter-module https://github.com/nulab/nginx-length-hiding-filter-module
- navait 11y agoThis has been shown by security researchers to be quite possible, and a serious vulnerability in many popular web applications. Not only could pages be guessed, they can build an entire state machine of the web application and use side channel attacks to guess what a user is sending in their HTTP requests. Side-channel leaks in web applications: A reality today, a challenge tomorrow : http://lasr.cs.ucla.edu/classes/239_1.fall10/papers/WebAppSideChannel-final.pdf http://lasr.cs.ucla.edu/classes/239_1.fall10/papers/WebAppSi...
- pcthrowaway 11y agoThe domain name would only be visible because of DNS requests.
- Buge 11y agoAnd also because of SNI.