Hacker News Reader

Comment by tobylane | Hacker News Reader

There's a difference between being the middle man so you can minify for the user, and logging all that goes through you. Just because we can't detect that change anyone who offers that service is a government lackey?

I like Opera Mini, which is just like this. But I hope my bank blocks it.

View on HN

Of course there is a difference between just Mitm for compression and outright eavesdropping. But with this point of attack a government can simply walk to Nokia with a court order, and Nokia will comply, most likely without much of a fight.

Or a little bit more abstract, the technical security is broken and the user relies on social norms for his privacy. The same social norms which forbid my ISP to sniff my non SSL traffic.

> But with this point of attack a government can simply walk to Nokia with a court order, and Nokia will comply, most likely without much of a fight.

Nokia might not even require a court order to let the government have access to your data. A court order is only to force Nokia to give access.

Certainly they don't log "all that goes through" them; that would be stupid and not really practical. However, nothing is stopping them from logging all data from specific persons of interest, or using MITM attacks to discover passwords, etc. Law enforcement, spy agencies, and others would be very interested in such a capability.

The whole point of HTTPS and end-to-end crypto in general is that you know the communication is private between just you and your counterparty. If you subvert HTTPS so that there are middle men, that is broken.

>There's a difference between being the middle man so you can minify for the user, and logging all that goes through you

How do you cache without storing?

You can minify without caching.

Reply on news.ycombinator.com