Timeline for What is the benefit of forcing a site to load over SSL (HTTPS)?
Current License: CC BY-SA 3.0
24 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 13, 2017 at 12:33 | history | edited | CommunityBot |
replaced http://webmasters.stackexchange.com/ with https://webmasters.stackexchange.com/
|
|
| Jul 15, 2016 at 14:50 | comment | added | Agent_L | @Schwern I already admitted you're right. But I never said it hides sites, I said it hides content within one site. Your example with subdomains shown that one has to be extra-careful even with that. | |
| Jul 12, 2016 at 16:05 | comment | added | Schwern |
@Agent_L Go into Tools -> Web Developer -> Network in Firefox (other browsers have similar) and watch the requests it's quietly making. All those domains can be seen on the network. Enough info leaks out around SSL that someone sniffing the network can know if you're looking at a controversial site. Don't tell people SSL alone hides what sites they're visiting. Don't tell them it's ok because they might get lucky on a big site like Tumblr or Google or Facebook. It's false security. Tell them to use secure DNS, or better yet, a non-logging VPN.
|
|
| Jul 12, 2016 at 8:48 | history | edited | Martijn | CC BY-SA 3.0 |
added 11 characters in body
|
| Jul 12, 2016 at 8:46 | comment | added | Agent_L | @Schwern You're right about the subdomains, I overlooked that. But it only means that a site can sacrifice privacy of the users for prettier urls. Tumblr was wrong example, my bad. But not every site does that. | |
| Jul 12, 2016 at 7:07 | history | edited | Martijn | CC BY-SA 3.0 |
added 8 characters in body
|
| Jul 11, 2016 at 16:27 | comment | added | Schwern |
@Agent_L No, even that is not good advice. If you go to https://penisland.tumblr.com/ your browser will do a DNS request for penisland.tumblr.com which, unless you've protected your DNS queries, the network admin can see. Then your browser has to get the images, Javascript, CSS, and ads from various domains which generate more DNS requests. They could be from any domain. The few porn Tumblr domains I tried don't have anything obvious, Tumblr tends to host images and videos in house, but you cannot rely on that for privacy.
|
|
| Jul 11, 2016 at 10:10 | history | edited | Martijn | CC BY-SA 3.0 |
added 327 characters in body
|
| Jul 11, 2016 at 8:14 | comment | added | Agent_L | @Schwern My admin can see that I'm browsing tumblr on my phone, but he can't tell if I'm watching pics of cute cats or hardcore porn. I'd say that's pretty damn good privacy. "a content" and "the content" can make all the difference in the world. | |
| Jul 11, 2016 at 7:33 | comment | added | Antzi | @Schwern it runs a DNS server on your computer. Connections between the DNS server and the outside world runs on SSL, while your applications use the normal, non encrypted SSL connection to the (local) DNS server. This way the unencrypted traffic does not leave your computer. | |
| Jul 11, 2016 at 7:17 | comment | added | Schwern | @MichaelKjörling Nobody here is arguing HTTP is better. As I said, the problem is giving people the idea that HTTPS means privacy (kudos to Martijn for editing the answer). This might lead someone to compromise themselves thinking their browsing is safe from scrutiny because they're using HTTPS. HTTPS is one element of ensuring privacy. | |
| Jul 11, 2016 at 7:11 | comment | added | Schwern | @Antzi Looks interesting! Does that work for any host? Or just for hosts which support it? | |
| Jul 11, 2016 at 4:26 | comment | added | Antzi | @Schwern alternative DNS such as DNSCrypt works too. | |
| Jul 10, 2016 at 20:20 | comment | added | Criticizing Israel not allowed | @MichaelKjörling What does whether HTTP exposes the server name have to do with whether HTTPS exposes the server name? | |
| Jul 10, 2016 at 14:48 | comment | added | Martijn | Ok, changed the example just a bit, though the simple example (though incorrect) could demo a situation the OP didnt think of :) | |
| Jul 10, 2016 at 14:47 | history | edited | Martijn | CC BY-SA 3.0 |
deleted 2 characters in body
|
| Jul 10, 2016 at 12:47 | comment | added | user | @Schwern I never understood the argument that HTTPS doesn't protect the host name because the DNS lookup and SNI and the server's certificate are in the clear. Of course that's true as stated, but plain text HTTP is by no means any better in this regard! | |
| Jul 9, 2016 at 16:28 | comment | added | Schwern | @Martijn Absolutely do use HTTPS, but it only creates privacy about the URL and page content. It doesn't prevent your IT department from knowing what sites you're visiting. You need more than HTTPS for that. | |
| Jul 8, 2016 at 20:35 | comment | added | Kevin | @Martijn: With Server Name Indication (which all modern browsers support), the hostname of the website is itself sent in the clear as part of the HTTPS handshake. It's not just a matter of sidechannel attacks and cannot be mitigated with e.g. DNSsec. | |
| Jul 8, 2016 at 18:39 | comment | added | Martijn | Yes, but saying "dont use https because there is DNS lookups" is like saying "YEah I have no lick because they can break a glass". Https should be standard IMO, just as the lock. It's a fine first step :) | |
| Jul 8, 2016 at 16:40 | comment | added | Schwern | Unfortunately SSL does not stop corporate IT or your ISP or people on the public cafe wifi with you from knowing what sites you're visiting. The DNS lookups are still done in the clear. While they can't see the content, nor the exact URL, nor that you're even using a web browser, they can see that you're accessing penisland.com (which is, of course, a site for pen enthusiasts, but might be misconstrued). Using a VPN or SOCKS5 proxy will protect your DNS queries. | |
| S Jul 8, 2016 at 14:49 | history | suggested | Lightness Races in Orbit | CC BY-SA 3.0 |
Fixed mistakes
|
| Jul 8, 2016 at 14:36 | review | Suggested edits | |||
| S Jul 8, 2016 at 14:49 | |||||
| Jul 8, 2016 at 12:09 | history | answered | Martijn | CC BY-SA 3.0 |