News for hackers. Stuff that matters.
Re:How Tor Works by kbart on Friday September 02, 2016 @02:18AM (#12411217)
Why do you need https for text only page? Sure, somebody could do deep packet inspection, but they would not find anything they couldn't find going to the domain (that won't be hidden by https anyway) directly.

EDIT: previously incorrectly stated 'url' instead of 'domain'.

Re:How Tor Works by nbraud on Friday September 02, 2016 @08:41AM (#12412601)
There are several reasons you want this, relating to security, privacy and “politics” (in the wider sense).

Regarding security, using HTTPS (along with the right measures on externally-hosted content) guarantees (to some extend) that what the users gets is what you meant to publish: an hostile network cannot replace the content with misinformation and cannot inject JS -- to exploit the client or not (as was done with the “Great Cannon” [0] which took down Github).

Privacy-wise, a number of countries routinely spy on their communication infrastructure, and revealing “I visited this website” is far more problematic than “I visited this Tor-related post on this website, and left this comment”.

The last reason for systematic HTTPS is “political”: if we go towards a situation where HTTPS is systematically employed, HTTP-only website will be subjected to increasing amounts of social pressure as adoption rates grow: deploying HTTPS (and preferably best-practices) on your “text-only” website pushes other websites (that might “need” it more) to deploy it too.

[0]: https://citizenlab.org/2015/04/chinas-great-cannon/

Re:How Tor Works by deltaprotocol on Friday September 02, 2016 @02:36AM (#12411288)
I don't know what is on a page until I visit it, so to make a stand myself in favor of a less insecure internet, I use HTTPS Everywhere in strict mode, which blocks HTTP. I have found that mostly I can live with it, and wish for the community (HN audience is a good part of it) to keep pushing (through a bit of pressure perhaps) towards an HTTPS only internet.
Re:How Tor Works by beardog on Friday September 02, 2016 @03:50AM (#12411582)
The problem with this is that it makes it very difficult to do network/isp level caching, this is especially problematic in areas where internet connectivity is slow, expensive, and limited.
Re:How Tor Works by hueving on Friday September 02, 2016 @04:45AM (#12411767)
It would be nice if https had a signature only mode so ISPs could cache but not meddle with the contents.
Re:How Tor Works by fiatjaf on Friday September 02, 2016 @08:13AM (#12412465)
Buy me certificates and I'll use HTTPS.
Re:How Tor Works by gldalmaso on Friday September 02, 2016 @08:21AM (#12412501)
Re:How Tor Works by niftich on Friday September 02, 2016 @02:21AM (#12411227)
For integrity, ie. tamper-resistance and knowing if MitM tampering was done.
Re:How Tor Works by justinlardinois on Friday September 02, 2016 @03:38AM (#12411530)
What's the end game for our hypothetical man in the middle? To edit the article to be subtly incorrect, so you'll misunderstand how Tor works?
Re:How Tor Works by white-flame on Friday September 02, 2016 @05:06AM (#12411829)
Given that this is a Tor article, let's talk about it. Tor exit nodes are a super easy place to perform snooping and injection on non-encrypted requests passing through that boundary. This has been used for simple snooping as well as demonstrated cache poisoning attacks that let the snooper inject JS into later https site requests like banks to exfiltrate passwords.
Re:How Tor Works by niftich on Friday September 02, 2016 @03:55AM (#12411603)
That's one possibility -- to misinform or give incorrect instructions. This may be more of a risk with this type of content than your run-of-the-mill personal blog.

A more frequent one is injection of ads or tracking scripts, or 'web accelerators' that recompress images. Certain ISPs have been known to do these.

Re:How Tor Works by x0137294744532 on Friday September 02, 2016 @03:53AM (#12411592)
Spy on our country's citizens with deep packet inspection and put anyone on a list that reads anything related to Tor. With HTTPS, the visit of this website would seem 'innocent'.
Re:How Tor Works by throwanem on Friday September 02, 2016 @07:55AM (#12412367)
It's a domain known to host Tor-related content, and HTTPS doesn't hide that you're connecting to it.
Re:How Tor Works by justinlardinois on Friday September 02, 2016 @05:43PM (#12416494)
This. HTTPS hides the details of your requests to sites you visit, but it doesn't hide the actual sites themselves.
Re:How Tor Works by beardog on Friday September 02, 2016 @03:53AM (#12411590)
Redirect to another website, push malware, show shock material, exploit a vulnerability in your browser.
Re:How Tor Works by c3833174 on Friday September 02, 2016 @06:53AM (#12412142)
All of those can be performed by an url shortening service or advertising or a compromised website (wordpress comes to mind) or ... etc.

/* insert ascii goatse here */

Re:How Tor Works by yoo1I on Friday September 02, 2016 @04:01AM (#12411622)
> that won't be hidden by https anyway

The only thing that's not hidden are the domain names in the certificate that the server presents.

The rest of the URL is encrypted, along with all data and headers.

Re:How Tor Works by nbraud on Friday September 02, 2016 @08:49AM (#12412634)
Assuming the server uses SNI, the domain name requested by the client is also sent in plaintext. Also, it's exposed anyway in DNS queries.
Re:How Tor Works by sasas on Friday September 02, 2016 @02:36AM (#12411293)
Javascript inserted that injects fake flash/ms/java update... fake redirect to a login page to capture credentials... the list goes on.
Re:How Tor Works by jahnu on Friday September 02, 2016 @03:19AM (#12411455)
But URLs are encrypted as it's the TCP connection that's encrypted, isn't it?!
Re:How Tor Works by beardog on Friday September 02, 2016 @03:51AM (#12411587)
Yes, snoopers can only see the domain you visit (not the full url). (although they can make good educated guesses based on file sizes)