Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Encrypted web traffic now exceeds 90%

netmarketshare.com

Post reply on HN
Print view View original

101–110 of 311 posts

Re: Encrypted web traffic now exceeds 90%

#101

Post by tialaramex »

svara wrote: post #73

We often hear the complaint here that nobody cares / cared about Snowden's revelations. But to me it seems he did provide a lot of the impetus for having HTTPS virtually everywhere and a lot of the instant messenging apps being end-to-end encrypted. Most of WhatsApp's users are as non-technical as it gets, and yet they use the kind of encryption that only computer enthusiasts were interested in just a couple years ag…

BCP 188 "Pervasive Monitoring Is an Attack" sets Best Common Practice for the IETF to say that mitigating pervasive monitoring is appropriate because it's an attack on the network. So that's a pretty long way from "nobody cares".

It's very carefully written, it does not propose to make a moral judgement about whether the things Snowden revealed are evil only to show that in a technical sense they were an attack and so it made sense for the network to try to mitigate them. Work like D-PRIVE (privacy for DNS) was driven by this concern, and of course it influenced a lot of other work including QUIC.

Re: Encrypted web traffic now exceeds 90%

#102

Post by phonethrowaway »

samatman wrote: post #98
gambler wrote: post #67

I don't know why so many people here are patting themselves on the back over this. This is not the kind of encryption people were talking about in the 90s and 00s. A lot of this encryption is not point-to-point. It merely secures user's interaction with some middleman (or their server). What would the numbers be if you subtracted all the traffic that can be snooped on by Google, Amazon and Cloudflare?

Several reasons: - The good is not the enemy of the perfect. - This eliminates an entire class of attacks, namely, man-in-the-middle. - A lot of (most?) user interactions require the server to know what the user wants, and it's unclear how this can happen if the server can't view the user's data.

MITM is not mitigated at all by HTTPS. What makes you think that? Do you understand how certificate signing works?

Re: Encrypted web traffic now exceeds 90%

#103

Post by [deleted] »

svara wrote: post #73

We often hear the complaint here that nobody cares / cared about Snowden's revelations. But to me it seems he did provide a lot of the impetus for having HTTPS virtually everywhere and a lot of the instant messenging apps being end-to-end encrypted. Most of WhatsApp's users are as non-technical as it gets, and yet they use the kind of encryption that only computer enthusiasts were interested in just a couple years ag…

[deleted]

Re: Encrypted web traffic now exceeds 90%

#105

Post by cesarb »

aesh2Xa1 wrote: post #14
Jonnax wrote: post #11

Nice. Remember the days when IT professionals would exclaim that this was a bad idea? Seems like it's cyclical thing. DNS over HTTPS is now the big bad technology.

No, haha. When was that a thing?

Back in the 1990s and early 2000s, it was very common to have "transparent proxies": your router or the ISP's router was configured to transparently redirect all connections to TCP port 80 to a Squid caching proxy or similar running on a nearby server. This meant that images, CSS, JS, or even whole pages (the web was much less dynamic back then) were transparently cached and shared between all users of that router. That could save a lot of bandwidth. Encrypting the HTTP connections completely bypassed the caching proxy; to make it worse, IIRC some popular browsers didn't cache the content from encrypted connections as well, so every new page view would have to come from the origin server. Obviously, the IT professionals which set up these caches didn't like it when most sites started switching to HTTPS, since it made the caches less useful.

Re: Encrypted web traffic now exceeds 90%

#106

Post by driverdan »

stjohnswarts wrote: post #89
vbezhenar wrote: post #10

I wonder how many fuel is burned to power servers and browsers to constantly encrypt and decrypt data which could be transferred much more efficiently unencrypted.

Not much with modern processors. And it's worth it, you can't put a price on privacy and rights to it.

Everything has its price.

Re: Encrypted web traffic now exceeds 90%

#108

Post by UncleMeat »

gpm wrote: post #83
stjohnswarts wrote: post #76

Earlier quoted context omitted.

What are you talking about about? I think you better look up how https/tls works??? Sure you have to trust the certificate authority. Also can you imagine the scandal that would erupt if Google or AWS cloud was discovered to be eavesdropping on companies running things in their cloud? I don't think so.

> can you imagine the scandal that would erupt if Google or AWS cloud was discovered to be eavesdropping on companies running things in their cloud Remember the "SSL added and removed here" image? https://thumbs.mic.com/MTBjNTQzNTMzZiMvbWVtejZOdjJsaUdUVkZEa...

That wasn't eavesdropping by Google. That was Google not using encrypted traffic on internal wires. And that changed a lot of years ago.

Re: Encrypted web traffic now exceeds 90%

#109

Post by andrewmunsell »

whydoyoucare wrote: post #88
svara wrote: post #77

Earlier quoted context omitted.

You're not wrong, but the realistic alternative is having it the same way, just without any encryption.

Which is fine too, since not all communication needs to be secure (even on the internet). These numbers are meaningless without a proper context and can potentially create a "security theater".

There's plenty of reasons to secure all communication as much as possible, regardless of the content.

Even if you don't care about what your ISP sees from a privacy standpoint, they still can inject ads or other content into your webpages if the connection isn't secured (at least, from the perspective of your ISP). And this helps prevent attacks against users in coffee shops or other public, unsecured WiFi.

Re: Encrypted web traffic now exceeds 90%

#110

Post by wolco »

stjohnswarts wrote: post #76
gambler wrote: post #67

I don't know why so many people here are patting themselves on the back over this. This is not the kind of encryption people were talking about in the 90s and 00s. A lot of this encryption is not point-to-point. It merely secures user's interaction with some middleman (or their server). What would the numbers be if you subtracted all the traffic that can be snooped on by Google, Amazon and Cloudflare?

What are you talking about about? I think you better look up how https/tls works??? Sure you have to trust the certificate authority. Also can you imagine the scandal that would erupt if Google or AWS cloud was discovered to be eavesdropping on companies running things in their cloud? I don't think so.

If that was discovered nothing would happen or change. To some degree has happened with Windows 10, android/iOS for personal computing.

They wouldn't monitor themselves but provide access to law agencies anyhow.

Post reply on HN