Hacker News Reader

Comment by redcalx | Hacker News Reader

They can't record the pages if the request is over https, as per most web sites these days. The IP address is known because it's necessary for routing traffic, but the content of each HTTP request and response is encrypted, and that's where the rest of the URL lives.

View on HN

They can (usually) extract the hostname of the site though, TLS includes it in plaintext.

Gov't can easily MITM HTTPS connections.

I did not know this. How do they do that?

http://security.stackexchange.com/questions/143387/is-there-...

That's pretty clear. It does depend of what level/technology is used in the Encryption, but broadly, against nation state actors with full virtual and physical hardware access, you are to put it bluntly, stuffed.

To anyone reading this, the link says: "It is unclear whether such rules would apply to companies which don't operate directly in the UK", so it is literally not pretty clear.

The _legality_ isn't clear. The technical methodology is quite clear.

True. Anyone know if this new IP law allows the gov to do this? I.e. if they tried to prosecute and it came to light that the logs were obtained using a MITM attack, would the evidence be nullified?

I don't know.

I imagine that MITM on a large scale is par for the course for GCHQ.

Sure, but can data obtained by that be used in a court of law. I /think/ those are two different things (but not sure).

It would probably come under the "Equipment Interference" section, which legalises hacking of devices.

Reply on news.ycombinator.com