gwern comments on Open thread, Feb. 9 - Feb. 15, 2015 - Less Wrong Discussion
You are viewing a comment permalink. View the original post to see all comments and the full post content.
You are viewing a comment permalink. View the original post to see all comments and the full post content.
Comments (321)
Simply sniffing https packets is worthless. At most it tells you the length of the session. It's exactly the adversary that TLS is designed to foil. You need the session key to decrypt it, so, you need to hook into the TLS implementation.
It seems someone has done the TLS hooking: TLSNotary. Whitepaper:
Seems it requires an active and online auditor server (which is far from ideal), but if someone were to run such a trusted auditor, then you get your HTTPS provability and can timestamp it as before.
I think that the people who wrote the code are running a server.
I am surprised that it is possible for a browser plug-in to hook so deeply into the browser to accomplish this.