News for hackers. Stuff that matters.

A comment on Https hurts users far away from the server. Parent comment

Re:Https hurts users far away from the server by cmdrfred on Friday March 10, 2017 @09:47AM (#13838926)
May I add an example. Let's say you are a drug company and you offer a number of different drugs. With TLS I only know that you are interested in a drug that company produces or the company itself, without it I know you or someone you care about has erectile dysfunction.
[ Parent | on HN ]
Re:Https hurts users far away from the server by spand on Friday March 10, 2017 @10:08AM (#13839108)
No that is not all an attacker could know. TLS does not provide confidentiality of the number of bytes transmitted. So in your example an attacker would only have to crawl the public website and find the pages matching in size to the ones you have been browsing.
[ Parent | on HN ]
Re:Https hurts users far away from the server by mi100hael on Friday March 10, 2017 @10:38AM (#13839358)
There are web server modules that will append random-length comments to the end of a page's HTML in order to foil this kind of attack

https://github.com/nulab/nginx-length-hiding-filter-module

[ Parent | on HN ]
Re:Https hurts users far away from the server by paulddraper on Friday March 10, 2017 @10:32AM (#13839316)
Cookies, user-agent header, and keep-alives will make that very hard to figure out.
[ Parent | on HN ]
Re:Https hurts users far away from the server by rplst8 on Friday March 10, 2017 @10:36AM (#13839343)
Couldn't this be thwarted by injecting random bytes into each page served to vary the file sizes?
[ Parent | on HN ]
Re:Https hurts users far away from the server by cmdrfred on Friday March 10, 2017 @10:17AM (#13839186)
Good point I hadn't considered that.
[ Parent | on HN ]