Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Spying on HTTPS

textslashplain.com

Post reply on HN
Print view View original

61–70 of 121 posts

Re: Spying on HTTPS

#61

Post by minitech »

icebraining wrote: post #18
dspillett wrote: post #14

Earlier quoted context omitted.

> That's the ISP's problem. No. It is the user's problem, created by the ISP. > Mine doesn't do that. Otherwise put: "It isn't a problem for me, so why is anyone working on the issue instead of something that I do care about" > I trust it more than Google, at any rate. Fair enough. Though for many, choosing not to use Google properties is a lot easier than choosing not to use an ISP that they don't entirely trust.

How do I choose not to use Google properties, including their ad services, analytics, captcha, maps, etc? Is there at least a comprehensive list of their domains, if I choose to block it all (despite that rendering half the web unusable)?

Blocking third parties with a tool like uMatrix will get you some of the way. Then you can generally avoid their products and block them at the top level manually, although it might be hard to avoid visiting websites that use Google Cloud, e-mailing people that use Gmail, or using software maintained by Google.

Re: Spying on HTTPS

#62

Post by jcranberry »

aiCeivi9 wrote: post #41
burkaman wrote: post #25

Earlier quoted context omitted.

I have seen it in at least one other project: https://blog.cloudflare.com/monsters-in-the-middleboxes/ , https://github.com/cloudflare/mitmengine I think it's equally understandable, and monster is objectively a more fun word. Seems like not a big deal?

Are we also going to change the middleman to middlemonster?

You could probably just say 'the monster' since presumably there's only one relevant monster. I don't think it's a big deal.

Re: Spying on HTTPS

#63

Post by [deleted] »

danShumway wrote: post #60
rumanator wrote: post #52

Earlier quoted context omitted.

Your attempt to force your personal blend of newspeak onto the world has no place in tech nor in this discussion. Please leave your gender politics activism out of an interesting technical discussion that affects us all. Besides being pointless and stupid, it only adds noise to the debate.

Discussions should get more civil over time, not less. GP never mentions gender in their post, but in terms of politics, it seems to me that this entire thread is a political conversation. It's certainly not technical -- a technical person would not care about whether someone used the term "monster" or "man", since: a) it changes literally nothing about the technical details of the attack. b) everyone understands wha…

[deleted]

Re: Spying on HTTPS

#64

Post by 2T1Qka0rEiPr »

Ajedi32 wrote: post #56
2T1Qka0rEiPr wrote: post #53

Earlier quoted context omitted.

Someone gets nefariously MITM'd and instead of giving the user an informative message, they're presented with something which means nothing to the lay-person.

But as I said, the rest of the text on that bar clearly explains what the message means, in terms a layman can easily understand. Is there anything lost by _also_ including the technical information necessary to diagnose the problem?

You mean "stability and security will suffer"? Sorry I didn't exclude it to try to make my point more convincingly, I just missed it altogether.

Assuming that's the part you meant, do you really think that is sufficient in explaining the situation to the user. I'm very unconvinced, my parents would have no idea what that means and just close the warning.

Re: Spying on HTTPS

#65

Post by hedora »

egdod wrote: post #15

> monster in the middle (MITM) That’s not what it stands for. There’s nothing sexist about using an acronym the same way everyone else does.

I take it to mean that all men are monsters.

If there were “woman in the middle” attacks, and people gender-neutralfied it to “witch in the middle”, there would be an uproar.

Yes, male witches are a thing, though it is a rare usage of the term (vs warlock), just like monsters are usually portrayed as male. Also, some women self-identify as witches for religious reasons. I still suspect there would be an uproar.

Re: Spying on HTTPS

#66

Post by Epokhe »

2T1Qka0rEiPr wrote: post #64
Ajedi32 wrote: post #56

Earlier quoted context omitted.

But as I said, the rest of the text on that bar clearly explains what the message means, in terms a layman can easily understand. Is there anything lost by _also_ including the technical information necessary to diagnose the problem?

You mean "stability and security will suffer"? Sorry I didn't exclude it to try to make my point more convincingly, I just missed it altogether. Assuming that's the part you meant, do you really think that is sufficient in explaining the situation to the user. I'm very unconvinced, my parents would have no idea what that means and just close the warning.

Well, your(and my) parents would download an .exe file to play Farmville and run it with admin privileges by clicking yes on the user account control popup. So, maybe a web browser is not the safest place for parents...

Re: Spying on HTTPS

#67

Post by robocat »

egdod wrote: post #15

> monster in the middle (MITM) That’s not what it stands for. There’s nothing sexist about using an acronym the same way everyone else does.

Eric answers the point in the comments: "recognizing that the MITM is neither male, nor human at all".

Personally, I suspect you are missing humour, and being over-sensitive, and making an incorrect assumption that it had anything to do with being PC.

Re: Spying on HTTPS

#68

Post by kbenson »

sascha_sl wrote: post #12
zzzcpan wrote: post #8

Earlier quoted context omitted.

> Being able to choose your ISP is a luxury many people, especially in the US, do not have. Elsewhere there might be choice, but none are really trustworthy. If you don't trust your ISP you really should use a VPN. You still have to trust your ISP if you don't and nothing that megacorps do can help you there.

TLS mitigates 90% of the things a VPN promises to do for you rather well. But you can get that up to 95 running a local DNS resolver with tls upstream.

Isn't that one of the reasons for DNS over HTTPS, which is being rolled out now[1] in some browsers? You can keep your ISP from seeing/intercepting/replacing DNS requests.

1: https://support.mozilla.org/en-US/kb/firefox-dns-over-https

Re: Spying on HTTPS

#69

Post by zzzcpan »

kbenson wrote: post #68
sascha_sl wrote: post #12

Earlier quoted context omitted.

TLS mitigates 90% of the things a VPN promises to do for you rather well. But you can get that up to 95 running a local DNS resolver with tls upstream.

Isn't that one of the reasons for DNS over HTTPS, which is being rolled out now[1] in some browsers? You can keep your ISP from seeing/intercepting/replacing DNS requests. 1: https://support.mozilla.org/en-US/kb/firefox-dns-over-https

There is no 90% or 95% neither with TLS nor with DoH. There are still IP addresses, OS-specific data in IP packets, response sizes, traffic patterns, SNI, active probing data, etc. ISPs can get so much stuff on you, you really should use a VPN if you don't trust your ISP.

Re: Spying on HTTPS

#70

Post by ignoramous »

Andrex wrote: post #44
userbinator wrote: post #6

Earlier quoted context omitted.

That's the ISP's problem. Mine doesn't do that. I trust it more than Google, at any rate.

You should absolutely not trust an ISP more than Google. Google monetizes your data themselves, while ISPs will pass it around to anyone with a couple bucks... If data privacy is your goal, keeping both at arms length would be ideal... except most people can't choose how much data* ISPs scoop up, or even choose to switch to a competitor if they disagree with an ISP's policies. *In contrast, you can control a decent a…

Agree. But...

> Google monetizes your data themselves

That's what I thought abt Facebook and Twitter: It looks like they might ship anonymized (or not) data to third-parties when appropriate. Amazon, too, make a lot of data available to sellers on their platform.

Google could be doing that, too, in the guise of claiming to do something else. Or, it already is.

Post reply on HN