Hacker News Reader

No, because you would want to keep the fact that you read something private.

Yes, and Roy's claim is that TLS doesn't provide that privacy, so is still basically useless for public content.

His argument is mostly based on analysing the size of the data transferred. Let's assume HTTP/2 for the moment. You have a single encrypted channel to a particular website that contains multiple interleaved opaque streams. It's not easily possible to extract the exact size of a single request from this. Furthermore, for a typical news website, for example, there will be an huge number of pages, they are dynamic and constantly changing and they will all have a very similar size.

You do get privacy. If anyone claims otherwise, he should go and prove that it's possible and easy by providing a firesheep-like tool. It would make for a nice research paper.

Here's an article describing how to find out what someone is watching on Google Maps by analyzing the encrypted traffic. http://blog.ioactive.com/2012/02/ssl-traffic-analysis-on-goo...

Fair enough, the HTTP request path can be hidden through TLS. I'm not sure if privacy is a goal of HTTPS, though.

On the internet layer, IP packets can still be traced from origin to client. I'm probably not involved enough to formulate an educated opinion, however.

Reply on news.ycombinator.com