Comment by tomjen3 | Hacker News Reader

Comment by tomjen3 | Hacker News Reader

This seems good, but too limited. Why not make it so that wikipedia can only be served over HTTPS?

I remember when the UK censored wikipedia because one page had an image they considered child porn and they transparently redirected the domain to point to a proxy. If they only serve it over HTTP this should hopefully break such a scheme - which isn't the perfect solution (that would be the very painful death of those involved with the censorship), but at least it makes it clear what is happening.

> This seems good, but too limited. Why not make it so that wikipedia can only be served over HTTPS?

That's what they're doing. From the second paragraph: "We will also use HTTP Strict Transport Security (HSTS)"

  * HSTS requires HTTPS connections  
  * Internet.org (currently) requires HTTP only [1]  
  * But Wikipedia is a member of Internet.org [2]

I'm curious how Wikipedia will handle this. Perhaps allowing Facebook to MITM?

Or maybe the security mentioned in the original article isn't intended for those who can't afford it[3].

  [1] https://developers.facebook.com/docs/internet-org/platform-technical-guidelines
  [2] https://internet.org/press/introducing-the-internet-dot-org-app
  [3] https://en.wikipedia.org/wiki/Wikipedia_Zero

HSTS only works after you connect over HTTPS. If you can only access a site over HTTP, HSTS doesn't do anything. So maybe people hitting WP from Internet.org can never get it over HTTPS in the first place?

Reply on news.ycombinator.com