Live data from Hacker News

Widespread Hijacking of Search Traffic in the United States

eff.org

11–19 of 19 posts

Re: Widespread Hijacking of Search Traffic in the United States

#11
post #9
post #6

Earlier quoted context omitted.

This is something I keep circling around. The host doesn't seem like a thing you could encrypt, because the intermediaries need to know where to send your packets. It seems like https encrypts the headers: http://stackoverflow.com/questions/187655/are-https-headers-... but does this include the Location header?

The HTTP request itself is encrypted, but the IP packet (including the source and destination IP addresses) is not. SSL/TLS is application level encryption, and if you wanted to encrypt the actual packet, you need to switch to something like IPsec, but even then you need some sort of routing method (which I can't remember).

IPSec can work in many different ways. One of those is to encapsulate the entire packet as the encrypted payload of a new packet, with the new packet having headers in plain text leading to the other end of the IPSec tunnel. That other end will then decrypt and forward as appropriate (this is called a 'tunnel').

Re: Widespread Hijacking of Search Traffic in the United States

#12
post #5

Earlier quoted context omitted.

My understanding is HTTPS only encrypts the content of the page, not the actual URL request. (And it's worth noting that proxies can unwrap HTTPS).

> proxies can unwrap HTTPS They cannot get at the plaintext without a certificate warning (or installing a certificate in the user's browser beforehand).

They cannot get at the plaintext without a certificate warning (or installing a certificate in the user's browser beforehand).

Which will get clicked through anyway, so, uh, the security is kinda moot. =)

Re: Widespread Hijacking of Search Traffic in the United States

#13
post #5

Earlier quoted context omitted.

My understanding is HTTPS only encrypts the content of the page, not the actual URL request. (And it's worth noting that proxies can unwrap HTTPS).

Your understanding is incorrect. This is the reason SSL is incompatible with virtual hosts (see http://en.wikipedia.org/wiki/Server_Name_Indication )

It's not! Just use the latest Apache. It works great. I have 30 domains on a single IP, all under SSL.

Re: Widespread Hijacking of Search Traffic in the United States

#14

Earlier quoted context omitted.

Your understanding is incorrect. This is the reason SSL is incompatible with virtual hosts (see http://en.wikipedia.org/wiki/Server_Name_Indication )

It's not! Just use the latest Apache. It works great. I have 30 domains on a single IP, all under SSL.

Which is great unless you have to deal with IE6 users :(.

Re: Widespread Hijacking of Search Traffic in the United States

#15
post #14

Earlier quoted context omitted.

It's not! Just use the latest Apache. It works great. I have 30 domains on a single IP, all under SSL.

Which is great unless you have to deal with IE6 users :(.

Does MS even support IE6 anymore? Or are people using it without the benefit of security patches? Where I work, IE7 is considered obsolete.

Re: Widespread Hijacking of Search Traffic in the United States

#16
post #14

Earlier quoted context omitted.

Which is great unless you have to deal with IE6 users :(.

Does MS even support IE6 anymore? Or are people using it without the benefit of security patches? Where I work, IE7 is considered obsolete.

IE6 has extended support until 2014 or market share is under 1%

http://en.wikipedia.org/wiki/Internet_Explorer_6

Re: Widespread Hijacking of Search Traffic in the United States

#18
post #12

Earlier quoted context omitted.

> proxies can unwrap HTTPS They cannot get at the plaintext without a certificate warning (or installing a certificate in the user's browser beforehand).

They cannot get at the plaintext without a certificate warning (or installing a certificate in the user's browser beforehand). Which will get clicked through anyway, so, uh, the security is kinda moot. =)

I don't know why you were downvoted for this, it's a very cogent point— most users would probably click through a big red screen that says "DO NOT VISIT THIS WEB SITE!" We need to be thinking of them when we design our security model.

Re: Widespread Hijacking of Search Traffic in the United States

#19

Earlier quoted context omitted.

Your understanding is incorrect. This is the reason SSL is incompatible with virtual hosts (see http://en.wikipedia.org/wiki/Server_Name_Indication )

It's not! Just use the latest Apache. It works great. I have 30 domains on a single IP, all under SSL.

Then it's using SNI, which I linked to. The request is still encrypted, but the host name is passed unencrypted using SNI.
Post reply on HN