News for hackers. Stuff that matters.

A comment on Optimizing HTTPS performance. Parent comment

Re:Optimizing HTTPS performance by majewsky on Sunday January 31, 2016 @04:15PM (#11008103)
I would argue it's a bad idea for images already. Images give away a lot about the type of content that you're viewing, which is possibly sensitive information.

Consider, for example, a Chinese computer connecting to Wikipedia over HTTPS, which then downloads an image over HTTP without S that is clearly related to the Tiananmen massacre.

[ Parent | on HN ]
Re:Optimizing HTTPS performance by theandrewbailey on Sunday January 31, 2016 @04:32PM (#11008180)
I'm not saying that it's a replacement for HTTPS. Nothing stops you from using SRI hashes for HTTPS content. If you're concerned over censorship, you should be using HTTPS, period. SRI is more concerned about bad CDN content. Your CDN can use HTTPS, but your server's page says what the hash should be, so if your CDN goes rouge, things will start breaking.
[ Parent | on HN ]