On: Tor Browser 10

[jonfw]

The state could easily track who accesses that GitHub page, if they control the ISP.

[remexre → jonfw]

That GitHub page in particular, versus any GitHub page? That'd involve a TLS break, no?

[jonfw → remexre]

Just did some research, and you're right! TLS obscures the URL by default. I didn't know that.

Only nuance being that an attacker can draw conclusions about the length of the URL- which won't be very helpful on Github.

[jerheinze → jonfw]

TLS alone is not sufficient. Fortunately, Github is also on the HSTS preload list.

[a1369209993 → jonfw]

> length of the URL

Also the length of the response, which is significantly more 'helpful', although probably not enough for a working attack unless you're willing to harrass a significant fraction of your intellectual workforce over false positives.

[pvarangot → remexre]

Yeah they need to hack or infiltrate Github, or get a warrant for your data.

[FandangoRanger → pvarangot]

Good thing Microsoft isn’t voluntarily in the PRISM progra-

[corobo → FandangoRanger]

Taking bets on "Microsoft was nudged into buying GitHub by one of the three letter clubs" being revealed one day

[b00pis → jonfw]

Especially in places like China where the Internet is heavily censored and Microsoft already has experience complying with the government's policies. https://www.wired.com/story/china-github-free-speech-covid-i...