Hacker News Reader

By default, doesn't firefox query OCSP responder for every TLS connection (unless the server offers OCSP stapling [1]) ? The privacy implications are pretty similar to Safe Browsing.

[1] https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-i...

View on HN

Not quite. In the case of OCSP, in the absence of OCSP stapling, all TLS connections are verified with an external server(s).

In that case of SafeBrowsing however, as noted in the article, for those URLs whose hash prefix doesn't match one of the hashes on one of the blacklists, the browser doesn't contact any other server. Only when there's a partial match does the browser ask for a full hash from the SafeBrowsing server.

Source: I'm a Chrome SafeBrowsing engineer.

Reply on news.ycombinator.com