Handbrake 0.10.0 released

Re:Handbrake 0.10.0 released by pokoleo on Sunday November 23, 2014 @06:25PM (#8650354)

This ~prevents people from modifying the binary that you download, but doesn't prevent them from knowing that you downloaded it.

[ Parent | on HN ]

Re:Handbrake 0.10.0 released by icebraining on Sunday November 23, 2014 @06:44PM (#8650398)

Going to the Handbrake site is a good clue (plus seeing a stream of a few MBs), and HTTPS doesn't protect them from knowing that, since they need to be the only site on that IP and/or use SNI, which sends the hostname in plaintext.

[ Parent | on HN ]

Re:Handbrake 0.10.0 released by akerl_ on Sunday November 23, 2014 @07:15PM (#8650475)

You realize that HTTPS doesn't hide what sites you visit, of course?

[ Parent | on HN ]

Re:Handbrake 0.10.0 released by JosephRedfern on Sunday November 23, 2014 @07:31PM (#8650512)

But it hides the HTTP request itself - Sourceforge hosts thousands of different projects, if served over HTTPS it'd be considerably harder to tell which download had been requested.

[ Parent | on HN ]

Re:Handbrake 0.10.0 released by dhbanes on Sunday November 23, 2014 @08:11PM (#8650587)

I'm pretty sure an HTTPS GET request to http[s]://iweb.dl.sourceforge.net/project/handbrake/0.10.0/HandBrake-0.10.0-MacOSX.6_GUI_x86_64.dmg would be pretty easy to identify as a HandBrake download. The resource requested is not hidden.

[ Parent | on HN ]

Re:Handbrake 0.10.0 released by quesera on Sunday November 23, 2014 @08:18PM (#8650603)

> The resource requested is not hidden.

Your GET request, and the server's reply, is encrypted.

The hostname of your request might leak in SNI, or if your DNS lookup was insecure.

It is also plausible that an eavesdropper could make a solid guess as to what you downloaded by counting bytes, but that's obviously not worth much.

[ Parent | on HN ]

Re:Handbrake 0.10.0 released by icebraining on Monday November 24, 2014 @04:40AM (#8651638)

The hostname of your request might leak in SNI, or if your DNS lookup was insecure.

You don't need a DNS leak; if you aren't using SNI, the server(s) replying on that IP can only serve a single cert, so the snooper can usually find out the hostname by simply connecting to it and seeing what it gets.

The exception is if the site is behind something like Cloudflare, which stuff dozens or hundreds of hostnames in a single cert.

[ Parent | on HN ]

Re:Handbrake 0.10.0 released by btgeekboy on Sunday November 23, 2014 @08:43PM (#8650662)

HTTPS works by first creating a TLS connection, then sending the HTTP request and response through it. Thus, the request (including the path) is encrypted.

[ Parent | on HN ]

Re:Handbrake 0.10.0 released by omnibrain on Monday November 24, 2014 @05:25AM (#8651758)

That's a common misconception and it's quite easy to fall for. Please read http://www.moserware.com/2009/06/first-few-milliseconds-of-h...

[ Parent | on HN ]

Re:Handbrake 0.10.0 released by dhbanes on Monday November 24, 2014 @10:57AM (#8652930)

Good read, thanks.

[ Parent | on HN ]

Re:Handbrake 0.10.0 released by dhbanes on Monday November 24, 2014 @10:57AM (#8652923)

Thanks for the clarification everyone.

[ Parent | on HN ]

Re:Handbrake 0.10.0 released by tomcorrigan on Sunday November 23, 2014 @08:23PM (#8650614)

You clearly don't understand how HTTPS works.

[ Parent | on HN ]

Re:Handbrake 0.10.0 released by __P on Sunday November 23, 2014 @09:25PM (#8650765)

It's interesting that this a concern, as this is a greater level of privacy than what we've enjoyed anywhere else. I'm thinking in real world contexts.

[ Parent | on HN ]