Earlier quoted context omitted.
This is something I keep circling around. The host doesn't seem like a thing you could encrypt, because the intermediaries need to know where to send your packets. It seems like https encrypts the headers: http://stackoverflow.com/questions/187655/are-https-headers-... but does this include the Location header?
The HTTP request itself is encrypted, but the IP packet (including the source and destination IP addresses) is not. SSL/TLS is application level encryption, and if you wanted to encrypt the actual packet, you need to switch to something like IPsec, but even then you need some sort of routing method (which I can't remember).
Widespread Hijacking of Search Traffic in the United States
11–19 of 19 posts
Re: Widespread Hijacking of Search Traffic in the United States
#12Earlier quoted context omitted.
My understanding is HTTPS only encrypts the content of the page, not the actual URL request. (And it's worth noting that proxies can unwrap HTTPS).
> proxies can unwrap HTTPS They cannot get at the plaintext without a certificate warning (or installing a certificate in the user's browser beforehand).
Which will get clicked through anyway, so, uh, the security is kinda moot. =)
Re: Widespread Hijacking of Search Traffic in the United States
#13Earlier quoted context omitted.
My understanding is HTTPS only encrypts the content of the page, not the actual URL request. (And it's worth noting that proxies can unwrap HTTPS).
Your understanding is incorrect. This is the reason SSL is incompatible with virtual hosts (see http://en.wikipedia.org/wiki/Server_Name_Indication )
Re: Widespread Hijacking of Search Traffic in the United States
#14Earlier quoted context omitted.
Your understanding is incorrect. This is the reason SSL is incompatible with virtual hosts (see http://en.wikipedia.org/wiki/Server_Name_Indication )
It's not! Just use the latest Apache. It works great. I have 30 domains on a single IP, all under SSL.
Re: Widespread Hijacking of Search Traffic in the United States
#15Earlier quoted context omitted.
It's not! Just use the latest Apache. It works great. I have 30 domains on a single IP, all under SSL.
Which is great unless you have to deal with IE6 users :(.
Re: Widespread Hijacking of Search Traffic in the United States
#16Earlier quoted context omitted.
Which is great unless you have to deal with IE6 users :(.
Does MS even support IE6 anymore? Or are people using it without the benefit of security patches? Where I work, IE7 is considered obsolete.
Re: Widespread Hijacking of Search Traffic in the United States
#17If you use Chrome a quick way to add it as a search engine: https://chrome.google.com/webstore/detail/lcncmkcnkcdbbanbja...
Re: Widespread Hijacking of Search Traffic in the United States
#18Earlier quoted context omitted.
> proxies can unwrap HTTPS They cannot get at the plaintext without a certificate warning (or installing a certificate in the user's browser beforehand).
They cannot get at the plaintext without a certificate warning (or installing a certificate in the user's browser beforehand). Which will get clicked through anyway, so, uh, the security is kinda moot. =)
Re: Widespread Hijacking of Search Traffic in the United States
#19Earlier quoted context omitted.
Your understanding is incorrect. This is the reason SSL is incompatible with virtual hosts (see http://en.wikipedia.org/wiki/Server_Name_Indication )
It's not! Just use the latest Apache. It works great. I have 30 domains on a single IP, all under SSL.