On: Marking HTTP as Non-Secure

[teh]

Reading certain articles reveals sensitive information about you, the reader, too.

Do you really want every node in the network to know that you like NSFW content or are heavily into my little pony?

[chippy → teh]

Would https be better in that regard? (e.g. tracking of visited URIs by the network)

[sjy → chippy]

Yes, because the URI is also encrypted in HTTPS (although it can get leaked in other ways; see the discussion at http://stackoverflow.com/questions/499591/are-https-urls-enc...).

[near → sjy]

But the host is not, and many services exist to categorize the content of domains already. What is the statistical difference between innocuous-site-with-every-kind-of-content-ever.com/friendship-is-pornographic and mlp-fip.com? If more sites are like the latter, then HTTPS will only hide which MLP pictures you are looking at, and not that you are looking at MLP porn. And if a site like the former became too large, we'd have to worry about the government issuing secret trace/tap requests against them.

[dfranke → sjy]

That thread misses the most important way: the length of the request and the length of the response. On most small sites, the combination of the two will be enough to uniquely identify what page you're visiting.