HTTPS and the illusion of privacy
blog.jeaye.com
HTTPS and the illusion of privacy
1–10 of 13 posts
Re: HTTPS and the illusion of privacy
#2I thought the article would mention web of trust and the flaws with CAs.
Re: HTTPS and the illusion of privacy
#3Also note that your browser sends the referer-header even on HTTPS if you dont explicitly tell it to not do so.
Re: HTTPS and the illusion of privacy
#4"Security does not mean privacy."
I sometimes stumble when I try to explain how security and privacy are different and usually I'll just explain with examples. I like these examples here.
When browsing a website which uses HTTPS, anyone viewing your traffic will be able to tell not only which website you’re viewing, but for how long and how frequently. (NOT really private) Though the content between you and the website is encrypted, (and so secure) the fact that you’re connected to the website’s IP is to be considered public knowledge.
Re: HTTPS and the illusion of privacy
#5Along the same lines, this paper is a great and slightly more comprehensive read on what TLS/HTTPS doesn't protect.
https://www.teamupturn.com/static/reports/2016/what-isps-can...
Re: HTTPS and the illusion of privacy
#6> the fact that you’re connected to the website’s IP is to be considered public knowledge.
As well as the domain name, because of SNI (Server Name Indication)
Re: HTTPS and the illusion of privacy
#7Hmm the article mentions MITM but no mention of HSTS?
Also I have some big issues with this statement: >Without encryption, all of your web browsing is to be considered public knowledge.
Even with encryption your web browsing history is "public knowledge", even without effective MITM attacks that break HTTPS any actor that can monitor the traffic between you and your ISP knows which websites you visit. Traffic analysis and profiling attacks can also reveal which specific pages / content you've visited based on statistical analysis of the request / response size, response time, and other factors.
Effective HTTPS doesn't hide what you are looking at, it ensures that whatever you sent and received cannot be tampered with (easily) and as well as adds some layer of secrecy to the data you send and receive if the attacker cannot gain it via other means.
Re: HTTPS and the illusion of privacy
#8Hmm the article mentions MITM but no mention of HSTS? Also I have some big issues with this statement: >Without encryption, all of your web browsing is to be considered public knowledge. Even with encryption your web browsing history is "public knowledge", even without effective MITM attacks that break HTTPS any actor that can monitor the traffic between you and your ISP knows which websites you visit. Traffic analys…
Great point bringing up web browsing history; I considered mentioning "private" modes, like Incognito Mode, but my primary concern with this post (as a sort of PSA) was that HTTPS does not mean we should trust services.
It might be worthwhile to provide another short-and-sweet (at least, that's my goal) post clearing up what I find to be common misconceptions about such private modes and what they offer, including what's stored in history, cookies, etc.
Re: HTTPS and the illusion of privacy
#9> the fact that you’re connected to the website’s IP is to be considered public knowledge. As well as the domain name, because of SNI (Server Name Indication)
Right, though the IP may be serving multiple domains. I omitted this due to the added complexity and aim to keep the post focused on a simple assertion: security != privacy.
Re: HTTPS and the illusion of privacy
#10I thought the article would mention web of trust and the flaws with CAs.
That'd focus more on the security aspect, and its details, as opposed to contrasting the security we (ideally) get with HTTPS and the privacy we hope to get when using services.