> if you visit wikipedia.org/whistleblowing
Just visiting, sure but if you edit it to leak a secret the protection is everything.
Say you are on your school network and leak something damaging about the school on Wikipedia.
Prior to Wikpedia switching to HTTPS, both the school and any intermediate network could see
- you visited Wikipedia
- you edited Wikipedia
- what you wrote on Wikipedia
- you visited Wikipedia
> if you edit it to leak a secret the protection is everything.
It’s really not, because knowing when you edited it is already enough, given that there’s a timestamped edit history. And the size and shape of your request payloads will show that you edited it, not merely performed GET requests.
and doesn't pervasive tls termination mean that Cloudflare/etc sees plaintext anyway? do we really believe that palantir isn't tapping into that?
i can imagine just a few scenarios where hiding content on the web actually achieves something. mainly stuff like webmail, web chats, banking.