Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

HTTPS can't verify that either, to be quite honest. It can ensure modest protection against a specific class of MITM attacks. If the traffic goes through a CDN like cloudflares it's decrypted, inspected, possibly manipulated and re-encrypted mid-flight. A well funded actor can also lean on the website owner, or just hack them.


TLS protects completely against network based MitM attacks.

CDNs are purposefully installed in MitM positions. That's a risk that the sites owner has to manage and it's an optional one at that.

A well funded actor would probably use different kind of vectors and not even bother with website MitM.


So why does catmemes.lol need to be encrypted with such urgency?


Because random ISPs will inject ads in websites for example.


That seems like a poor choice of ISP to me. If I dial my phone and have to listen to ad jingles before it connects, I'm changing my phone company.


That type of response comes from a place of privilege. Many have no choice over ISP.


Dysfunctional markets is a legal problem, not a technical one. Concealing the consequences of market dysfunction with technological band-aids only serves to preserve the status quo.


This is just a deeply unhelpful way to think.

Firstly it punishes those in the worst situations. Those in countries with abusive political systems, those who have no legal representation, etc.

I don't even believe the idea is right in practice "serves to preserve the status quo" is just wrong in this case. HTTPS completely breaks most terrible things ISPs can do. It completely dismantles the system.


> Firstly it punishes those in the worst situations. Those in countries with abusive political systems, those who have no legal representation, etc.

HTTPS offers virtually no defense against a state actor.

> I don't even believe the idea is right in practice "serves to preserve the status quo" is just wrong in this case. HTTPS completely breaks most terrible things ISPs can do. It completely dismantles the system.

HTTPS doesn't dismantle the system at all. You're still stuck with no other option for an ISP, which means you are not going to get favorable terms. And even with HTTPS, you need to look up the IP for the servers you're going to visit, and ISPs can snoop on your DNS traffic and sell information about how you, the IP (or the person), regularly looks up the IP for abortionpills.example.com (or connects to the IP associated with the server).


They get an IP but an IP does not always equal a hostname.


It's just one data point though. The real juice comes when you have a hundred thousand traffic logs to compare, then you can start inferring similarities even from vague and incomplete data points.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: