3 ms·
> TLS is NOT desirable for access to public information, except in that it provides an ephemeral form of message integrity that is a weak replacement for conten
by dfabulich 11y ago
> TLS is NOT desirable for access to public information, except in that it provides an ephemeral form of message integrity that is a weak replacement for content integrity.
TLS both encrypts and authenticates the response. Is TLS authentication a "weak replacement" for some other, better "content integrity" system that's widely available in browsers?
Roy suggests content signatures... but is there a web mechanism to authenticate those? Or is he just wishing there were something better than TLS? (Don't we all?)
- URSpider94 11y agoI think his point is not that TLS is not good at securing information from the host to the viewer, his point is that in doing so, it leaks information about the viewer to the host and potentially to third parties. For public information, TLS effectively asks each viewer to sign the guest register in return for seeing the page. Contrast this with the case where you could download one giant file with hashes for millions of public sites. Once you have a copy of that file, you can now fetch a copy of any of those pages from any source you like, and still validate that your copy is authentic without losing any trace that you accessed that file.