Hacker News Reader

Comment by frik | Hacker News Reader

Yes, exactly. But why? What's the agenda? Why now? It's not like Amazon.com was broken between 1996 and 2016. There is a push to HTTPS at all costs, even if things (ad networks, devs, software) is not ready and is there even a need for 100% TLS? That an open source browser is engaged in such initiative is not good. With HTTP you can be anonymous, and most website visits aren't mission critical things. With HTTPS your traffic is quite unique and the players with big money have the resources anyway, there TLS is no big thing as we learned in the last few years. So which Think-tank or what ever is behind this initiative?

View on HN

Even if it's not a mission critical web request, isp's injecting content into your http pages is unacceptable.

Even if the government could brute force or fingerprint one of your TLS sessions, they can't do it for everyone for every site.

Just because Amazon wasn't broken doesn't mean we can't improve it.

Also your comment about a think tank coming up with this idea is an odd insult, given how broadly you can empirically see people support this.

Hmmm but i am pretty sure ISP and Ad Agents(Google etc..) will figure a way to inject content.

Well... They won't be able to. If they can figure out a way it means they have broken the underlying encryption, so that gets fixed.

>there TLS is no big thing as we learned in the last few years

Citation? We've learned what has always thought to have been true: Encryption works very well and intel collectors need to resort to attacking other aspects. TLS has had its share of flaws but it's still very much a "big thing" to defeat.

You believe TLS makes it easier to track you?

Is this based on some odd notion of ClientAuth?

This is a great opportunity to get people to use TLS across the board. The carrot is HTTP/2.

> With HTTPS your traffic is quite unique

What's more unique about HTTPS traffic than HTTP traffic?

Your supported ciphers contribute to your browser fingerprint maybe?

I cannot imagine that the supported ciphers could be more identifying than your user agent, all cookies, all headers, query string, and request body.

Reply on news.ycombinator.com