News for hackers. Stuff that matters.

A comment on Stanford researchers find only 3% of HTTP runs on port 80 [pdf]. Parent comment

Re:Stanford researchers find only 3% of HTTP runs on port 80... by ViVr on Wednesday March 01, 2023 @10:18PM (#34991500)
HTTPS improves security even for a static site because it prevents an ISP or middleman from injecting ads (or worse) into the page.

It also increases privacy because the contents of the traffic can not be observed by third parties.

[ Parent | on HN ]
Re:Stanford researchers find only 3% of HTTP runs on port 80... by marpstar on Wednesday March 01, 2023 @10:20PM (#34991522)
Right, but for a static site that’s publicly accessible, even HTTPS leaks the requested URL, any listener can go fetch that page themselves to see the contents.
[ Parent | on HN ]
Re:Stanford researchers find only 3% of HTTP runs on port 80... by snowwrestler on Wednesday March 01, 2023 @10:33PM (#34991627)
HTTPS does not leak the requested URL to servers between the client and the server.
[ Parent | on HN ]
Re:Stanford researchers find only 3% of HTTP runs on port 80... by dmitrygr on Wednesday March 01, 2023 @10:29PM (#34991599)
> even HTTPS leaks the requested URL

It does not. In the olden days the host name was leaked, but with SNI even that is gone. Anything past the first "/" is never and was never sent in plaintext in HTTPS

[ Parent | on HN ]
Re:Stanford researchers find only 3% of HTTP runs on port 80... by cperciva on Wednesday March 01, 2023 @10:37PM (#34991656)
Most public web sites leak information about page accesses to anyone who can count bytes.
[ Parent | on HN ]
Re:Stanford researchers find only 3% of HTTP runs on port 80... by teaearlgraycold on Wednesday March 01, 2023 @10:48PM (#34991749)
What kind of attack are you describing?
[ Parent | on HN ]
Re:Stanford researchers find only 3% of HTTP runs on port 80... by cperciva on Wednesday March 01, 2023 @10:53PM (#34991788)
Count how many bytes of TCP traffic you see. Measure the size of each web page on the (public static) website.
[ Parent | on HN ]
Re:Stanford researchers find only 3% of HTTP runs on port 80... by fmajid on Thursday March 02, 2023 @04:26AM (#34993756)
The host name is still leaked, SNI is not encrypted and ESNI is still not mandatory in TLS 1.3.
[ Parent | on HN ]
Re:Stanford researchers find only 3% of HTTP runs on port 80... by 2h on Thursday March 02, 2023 @07:39AM (#34994939)
> host name was leaked, but with SNI even that is gone

nope, you can still see it perfectly fine:

https://tlshello.agwa.name/

please don't spread misinformation.

[ Parent | on HN ]
Re:Stanford researchers find only 3% of HTTP runs on port 80... by dmitrygr on Thursday March 02, 2023 @07:47AM (#34995005)
ESNI*
[ Parent | on HN ]
Re:Stanford researchers find only 3% of HTTP runs on port 80... by 2h on Thursday March 02, 2023 @06:11PM (#35003407)
OK, now name at least two public servers that use that. I will wait...
[ Parent | on HN ]