Hacker News Reader

Comment by semenko | Hacker News Reader

They clearly mention this goal in their blog post:

http://blog.wikimedia.org/2013/08/01/future-https-wikimedia-...

Wikimedia seems to make a habit out of "considering" things for a long time before actually enabling them. Enabling forward secrecy is relatively straightforward.

Yes. However, if you do that, perhaps you're less motivated to find solutions to other, equally important problems with HTTPS.

  Enabling perfect forward secrecy is only useful if we also
  eliminate the threat of traffic analysis of HTTPS, which
  can be used to detect a user’s browsing activity, even
  when using HTTPS.

Traffic analysis is certainly an orthogonal problem to decryption of the ciphertext here. There's no reason to wait on one for the other.

At the scale of Wikimedia nothing is straightforward. Not even relatively.

This. We're talking about the fifth most popular site on the Web, operating on a budget smaller than my department at work.

Reply on news.ycombinator.com