Hacker News Reader

If the content is already encrypted & signed (like imessage & app store content) there is little to be gained by using TLS and a performance cost particularly in latency on unreliable connections (mobile, packet loss, etc).

Did you take a look at the data that's being sent? Are photos encrypted and signed in transport like Apple claims?

View on HN

No, I did not take a look at the data being sent. I'm sure that in most of the cases I cited, the HTTP payload is encrypted or at least signed. At the very least, using plain HTTP to communicate with S3 will leak some additional metadata contained in HTTP headers. That may or may not be sensitive or privacy-compromising metadata, but it is metadata that does not need to be leaked.

Reply on news.ycombinator.com