theherk

u/theherk@lemmy.world
23 posts · 1.8k comments

Recent posts

Recent comments

Depends what you mean by “fine”. Tor will still guarantee anonymity through the three-hop model, and no they cannot see the contents of your traffic. But it really depends on your risk tolerance. The real problem in this scenario is traffic analysis.

I’m not sure how the video stream packets look in that scenario but they may still be able to infer through protocol or density that some video is streaming and block that. Again, without knowing what is in the stream.

But you have to be cautious about other attackers in the network targeting your device. Those risks can circumvent all sorts of safety you might think you have.

It doesn’t. The code your site provides is downloaded by your client’s browser. It uses a key on their side that is never sent back to your server. Same as if you did it with an extension or application. This is well trodden ground, and used across the internet such that hosts have zero knowledge of their users’ data aside from in its encrypted state.


Actually, let me give a little ground here. There is a subtle but real benefit to an extension or signed application. With just JavaScript, a server could on a new page load deliver an altered code that would introduce a compromise. If that is the threat you want to mitigate for, you’re onto something. If you’re talking high stakes, and you make it clear this is the threat for which you’re protecting users, then I could be convinced.

I mean no offense by this at all, but I wouldn’t because it would indicate a poor understanding of cryptography to me as a user. Either that or being intentionally misleading. In either case, probably unsafe for the user. There does not need to be an extension to encrypt content such that the server never has access to it. It can be encrypted and sent to the host with a key the server never possesses.