Hacker News Reader

Comment by JoshTriplett | Hacker News Reader

This is the kind of thing I think of every time someone suggests that there exist sites that "don't need HTTPS".

All sites need HTTPS, and all protocols need TLS or equivalent; plaintext should never appear on the wire.

While I agree, there's a reason that file sharing and video sites have been slow to take up HTTPS, and that's that it removes the ability for any intermediaries to cache the content. It puts more of a burden on ISPs and services to carry the extra load, whether it be through SSL-terminated peering, or more scaling at the home servers. It may be a necessary burden, but still, it's a pretty significant one.

In extreme cases, think of the infrastructure cost of streaming say, a world cup final game over HTTP vs HTTPS.

I see that as a good thing, it's an argument for ISPs to finally invest in upgrading their networks, though if Google Fiber wasn't already enough of a reason I doubt this would make a dent.

I'm not disagreeing with you, but HTTPS is irrelevant if a motivated adversary can detect that you've downloaded 5GB over the past 5 minutes from https://www.example.com/disney-frozen-0day-full-length. Without additional protocols, encrypted channels are still subject to traffic analysis.

They'll only see 5GB from www.example.com:443, the request path is protected by HTTPS. With some kind of DNS security they'd only see 5GB from 12.23.34.45:443.

The IP is well know so I'm not sure I follow the point about DNS. Also note it's not that they see 'about 5GB' but the size of every packet and exactly when they were sent / or in reply to what other packets. They can also have bots watching for all new content as its posted and who downloads files of the same size, etc. I would assume HTTPS will not stop someone from knowing what files you are downloading from a nation-state adversary.

I’d guess exact file size is mostly unique in movies/large files. A good heuristic at least.

Reply on news.ycombinator.com