Widespread Hijacking of Search Traffic in the United States
1–10 of 19 posts
Re: Widespread Hijacking of Search Traffic in the United States
#2This says a lot about the ISP's ethics if they are shown to be consenting to this. One thing I didn't see in the EFF article is something a user could do about it: use SSL! This may eventually force these companies into more nefarulious and active techniques of hijacking, but it should alleviate the basic technique they are employing now, if i am not mistaken.
Re: Widespread Hijacking of Search Traffic in the United States
#3This says a lot about the ISP's ethics if they are shown to be consenting to this. One thing I didn't see in the EFF article is something a user could do about it: use SSL! This may eventually force these companies into more nefarulious and active techniques of hijacking, but it should alleviate the basic technique they are employing now, if i am not mistaken.
From the EFF article:
"And the best protection against the privacy and security risks created by this type of hijacking is to visit sites using HTTPS rather than HTTP, which can easily be achieved using EFF's HTTPS Everywhere Firefox extension"
Re: Widespread Hijacking of Search Traffic in the United States
#4This says a lot about the ISP's ethics if they are shown to be consenting to this. One thing I didn't see in the EFF article is something a user could do about it: use SSL! This may eventually force these companies into more nefarulious and active techniques of hijacking, but it should alleviate the basic technique they are employing now, if i am not mistaken.
From the EFF article: "And the best protection against the privacy and security risks created by this type of hijacking is to visit sites using HTTPS rather than HTTP, which can easily be achieved using EFF's HTTPS Everywhere Firefox extension"
You're right, sry. Was on my mobile and must have glossed over that. Next time I will RTFA fully.
Re: Widespread Hijacking of Search Traffic in the United States
#5This says a lot about the ISP's ethics if they are shown to be consenting to this. One thing I didn't see in the EFF article is something a user could do about it: use SSL! This may eventually force these companies into more nefarulious and active techniques of hijacking, but it should alleviate the basic technique they are employing now, if i am not mistaken.
From the EFF article: "And the best protection against the privacy and security risks created by this type of hijacking is to visit sites using HTTPS rather than HTTP, which can easily be achieved using EFF's HTTPS Everywhere Firefox extension"
My understanding is HTTPS only encrypts the content of the page, not the actual URL request.
(And it's worth noting that proxies can unwrap HTTPS).
Re: Widespread Hijacking of Search Traffic in the United States
#6Earlier quoted context omitted.
From the EFF article: "And the best protection against the privacy and security risks created by this type of hijacking is to visit sites using HTTPS rather than HTTP, which can easily be achieved using EFF's HTTPS Everywhere Firefox extension"
My understanding is HTTPS only encrypts the content of the page, not the actual URL request. (And it's worth noting that proxies can unwrap HTTPS).
This is something I keep circling around. The host doesn't seem like a thing you could encrypt, because the intermediaries need to know where to send your packets. It seems like https encrypts the headers: http://stackoverflow.com/questions/187655/are-https-headers-...
but does this include the Location header?
Re: Widespread Hijacking of Search Traffic in the United States
#7Earlier quoted context omitted.
From the EFF article: "And the best protection against the privacy and security risks created by this type of hijacking is to visit sites using HTTPS rather than HTTP, which can easily be achieved using EFF's HTTPS Everywhere Firefox extension"
My understanding is HTTPS only encrypts the content of the page, not the actual URL request. (And it's worth noting that proxies can unwrap HTTPS).
> proxies can unwrap HTTPS
They cannot get at the plaintext without a certificate warning (or installing a certificate in the user's browser beforehand).
Re: Widespread Hijacking of Search Traffic in the United States
#8Earlier quoted context omitted.
From the EFF article: "And the best protection against the privacy and security risks created by this type of hijacking is to visit sites using HTTPS rather than HTTP, which can easily be achieved using EFF's HTTPS Everywhere Firefox extension"
My understanding is HTTPS only encrypts the content of the page, not the actual URL request. (And it's worth noting that proxies can unwrap HTTPS).
Your understanding is incorrect. This is the reason SSL is incompatible with virtual hosts (see http://en.wikipedia.org/wiki/Server_Name_Indication)
Re: Widespread Hijacking of Search Traffic in the United States
#9Earlier quoted context omitted.
My understanding is HTTPS only encrypts the content of the page, not the actual URL request. (And it's worth noting that proxies can unwrap HTTPS).
This is something I keep circling around. The host doesn't seem like a thing you could encrypt, because the intermediaries need to know where to send your packets. It seems like https encrypts the headers: http://stackoverflow.com/questions/187655/are-https-headers-... but does this include the Location header?
The HTTP request itself is encrypted, but the IP packet (including the source and destination IP addresses) is not. SSL/TLS is application level encryption, and if you wanted to encrypt the actual packet, you need to switch to something like IPsec, but even then you need some sort of routing method (which I can't remember).
Re: Widespread Hijacking of Search Traffic in the United States
#10Earlier quoted context omitted.
My understanding is HTTPS only encrypts the content of the page, not the actual URL request. (And it's worth noting that proxies can unwrap HTTPS).
This is something I keep circling around. The host doesn't seem like a thing you could encrypt, because the intermediaries need to know where to send your packets. It seems like https encrypts the headers: http://stackoverflow.com/questions/187655/are-https-headers-... but does this include the Location header?
Yes.
SSL / TLS happens below HTTP at the socket layer. This is why you couldn't have vhosts's using SSL on a single IP for a very long time (the webserver wouldn't know which certificate to use).