Stanford researchers find only 3% of HTTP runs on port 80 [pdf]

Re:Stanford researchers find only 3% of HTTP runs on port 80... by dmitrygr on Wednesday March 01, 2023 @10:29PM (#34991599)

> even HTTPS leaks the requested URL

It does not. In the olden days the host name was leaked, but with SNI even that is gone. Anything past the first "/" is never and was never sent in plaintext in HTTPS

[ Parent | on HN ]

Re:Stanford researchers find only 3% of HTTP runs on port 80... by cperciva on Wednesday March 01, 2023 @10:37PM (#34991656)

Most public web sites leak information about page accesses to anyone who can count bytes.

[ Parent | on HN ]

Re:Stanford researchers find only 3% of HTTP runs on port 80... by teaearlgraycold on Wednesday March 01, 2023 @10:48PM (#34991749)

What kind of attack are you describing?

[ Parent | on HN ]

Re:Stanford researchers find only 3% of HTTP runs on port 80... by cperciva on Wednesday March 01, 2023 @10:53PM (#34991788)

Count how many bytes of TCP traffic you see. Measure the size of each web page on the (public static) website.

[ Parent | on HN ]

Re:Stanford researchers find only 3% of HTTP runs on port 80... by fmajid on Thursday March 02, 2023 @04:26AM (#34993756)

The host name is still leaked, SNI is not encrypted and ESNI is still not mandatory in TLS 1.3.

[ Parent | on HN ]

Re:Stanford researchers find only 3% of HTTP runs on port 80... by 2h on Thursday March 02, 2023 @07:39AM (#34994939)

> host name was leaked, but with SNI even that is gone

nope, you can still see it perfectly fine:

https://tlshello.agwa.name/

please don't spread misinformation.

[ Parent | on HN ]

Re:Stanford researchers find only 3% of HTTP runs on port 80... by dmitrygr on Thursday March 02, 2023 @07:47AM (#34995005)

ESNI*

[ Parent | on HN ]

Re:Stanford researchers find only 3% of HTTP runs on port 80... by 2h on Thursday March 02, 2023 @06:11PM (#35003407)

OK, now name at least two public servers that use that. I will wait...

[ Parent | on HN ]