News for hackers. Stuff that matters.
Re:Tor and HTTPS by belorn on Sunday June 09, 2013 @09:21AM (#5848797)
An excellent illustration for those already familiar with the concepts.

However, I not sure its that easy to understand for those who don't know what "location" means, and the text is slightly small and hard to read. It would be a great improvement if they showed a small help text if one hovered over a label inside one of the yellow boxes.

Still, a very excellent job of EFF.

Re:Tor and HTTPS by claudius on Sunday June 09, 2013 @09:29AM (#5848826)
There’s a little description text at the top explaining the meaning of the various labels, including ‘location’ (the last bullet point).
Re:Tor and HTTPS by belorn on Sunday June 09, 2013 @09:38AM (#5848864)
The term "IP address" would be similarly confusing. What would help is if they explained in context what it means, for example when a lawyer of one's ISP knows about location and site (possible termination of contract, providing it to NSA, selling it and so on).

Also, using a help window when hovering would be a quite better UX than a glossary.

Re:Tor and HTTPS by eugene-d on Sunday June 09, 2013 @09:31AM (#5848838)
I guess "location" means "IP Address". It's not your location in the URL bar, as HTTPS encrypts the connection, not just HTTP request body.
Re:Tor and HTTPS by icebraining on Sunday June 09, 2013 @09:35AM (#5848853)
HTTPS doesn't encrypt the domain. That said, Tor does.
Re:Tor and HTTPS by buzzkills on Sunday June 09, 2013 @12:09PM (#5849385)
https encrypts the host header (indeed all the http headers), so yes it does encrypt the domain in that respect. What it can't encrypt is the destination IP address, which would be reverse looked up to the domain if everything was configured right in the DNS.
Re:Tor and HTTPS by knome on Sunday June 09, 2013 @12:20PM (#5849428)
This is no longer true.

Seeing as HTTPS sites could not previously share an IP address, making it obvious which site communications with any given IP address was directed towards, an extension was developed that now sends the desired host unencrypted before the encrypted package.

This doesn't yield any more information that could previously be derived, but does allow you to serve as many HTTPS sites from a single host as you wish.

http://en.wikipedia.org/wiki/Server_Name_Indication

Re:Tor and HTTPS by buzzkills on Sunday June 09, 2013 @02:42PM (#5849977)
I stand corrected and I've learnt something :)
Re:Tor and HTTPS by mfenniak on Sunday June 09, 2013 @12:16PM (#5849411)
Most https clients support server name indication (http://en.wikipedia.org/wiki/Server_Name_Indication), which effectively allows the "Host" header content to be presented before a server-side certificate is chosen (and therefore before the session is encrypted), to supported name-based virtual hosting.
Re:Tor and HTTPS by Ives on Sunday June 09, 2013 @09:40AM (#5848868)
You guessed right, see the key on top.