Hacker News Reader

Comment by gipp | Hacker News Reader

Sure, but this is why pretty much every resource on Tor stresses the importance of end-to-end encryption for sensitive or identifying info.

View on HN

That's why I mention sslstrip (check out the presentation - it's scary) and overall lack of SSL on the internet. To provide some anecdata, my browser window currently has 8 tabs open right now.

Those that support HTTPS: news.ycombinator.com; twitter.com; www.torproject.org

Those that don't: cryptome.org (!); zzaper.co.uk (the Vim tips article from a few days ago); forbes.com; vimeo.com; nytimes.com

End-to-end encryption would be great, but the internet at large just isn't there yet in terms of both HTTPS support on most sites and safeguards against SSL tampering.

I will say safeguards against tampering are getting better for newer browsers. I'm working on a software stack for PirateBox type systems but focused on security, so I get a pretty good glimpse at how a lot of sites handle incorrect certs, since it's an internetless portal and redirects everything to its hosted SSL page. Both gmail and hackernews will refuse to load at all, as they properly support HSTS. Well gmail "cheats" and is hard coded in chrome.

So how does Gmail do it with other browsers?

http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security#...

What is the use to an exit node in knowing that someone is reading cryptome zzaper forbes vimeo and nytimes? Presumably you are not going to transfer any identifying info to these sites.

Tracking cookies used across various services are known to be used by the NSA to identify users.

If you're using the same browser for Tor and non-Tor traffic (and therefore the same cookies) then You Are Doing It Wrong.

That's why the Tor Browser clears cookies on close. But you are free to disable them entirely.

Reply on news.ycombinator.com