undefined | Better HN

0 pointselithrar6y ago0 comments

Disagree.

- TLS is still important to stop tampering of video content or images, as well as user privacy over what content was specifically viewed.

- Some ISPs have (and still do) intercept plaintext video content -> transcode to a much lower bitrate -> cache that for their users. That hurts the content provider, as they lose visibility (logs/metrics), and the user who may suffer a reduced experience that the content provider can’t easily fix. End-to-end TLS solves that.

0 comments

4 comments · 2 top-level

eknkc6y ago· 2 in thread

Well the API that is behind TLS can provide content verification data (file hashes).

Then the client can reject any tampered stuff even without encryption on the transport.

elithrarOP6y ago

That still breaks the experience. Now you have tampered content AND broken clients.

TLS does wonders for preventing transparent proxies, DPI & ISPs from modifying or tracking what you see.

dwild6y ago

> That still breaks the experience. Now you have tampered content AND broken clients.

You won't have tampered content if the data is rejected, that's absurd. You can do the same with TLS by the way, that's the whole point of TLS, being able to verify (and thus reject or not) data.

Sure it break the client, but you can do that in any situation, just have to unplug a wire ;).

dwild6y ago

My whole point was about using hash to verify the integrity of the data, so no they wouldn't be able to tamper with anything, that's the whole point of it.

You bring a good point about user privacy, and for sure a key can help with that, but at the end of the day, there's not much you can do about this once the physical server is somewhere else, TLS or not, you'll need to trust the one that hold physically that server not to void user privacy.

I would still suggest a TLS connection for that server, but it would most probably be self signed with a different root certificate to avoid someone else to be able to make others trust him being Apple over something that wouldn't verify the content with hash coming from platform owned by Apple.

j / k navigate · click thread line to collapse

0 comments

4 comments · 2 top-level

eknkc6y ago· 2 in thread

Well the API that is behind TLS can provide content verification data (file hashes).

Then the client can reject any tampered stuff even without encryption on the transport.

elithrarOP6y ago

That still breaks the experience. Now you have tampered content AND broken clients.

TLS does wonders for preventing transparent proxies, DPI & ISPs from modifying or tracking what you see.

dwild6y ago

> That still breaks the experience. Now you have tampered content AND broken clients.

You won't have tampered content if the data is rejected, that's absurd. You can do the same with TLS by the way, that's the whole point of TLS, being able to verify (and thus reject or not) data.

Sure it break the client, but you can do that in any situation, just have to unplug a wire ;).

dwild6y ago

My whole point was about using hash to verify the integrity of the data, so no they wouldn't be able to tamper with anything, that's the whole point of it.

j / k navigate · click thread line to collapse