Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote -1 down vote favorite

I installed Convergence on Firefox 9.0.1:

http://convergence.io/

but... after I installed/enabled it when I visit a HTTPS only-site there are many-many HTTP traffic to the notary servers. Why? shouldn't those connections be encrypted?? Can someone explain it to me please?

share|improve this question
Have you looked at the content of those requests? Do they need to be encrypted or not? – Rory Alsop♦ Jan 4 '12 at 23:56
I have no idea that they need encryption or not :) – LanceBaynes Jan 5 '12 at 6:09

1 Answer

up vote 0 down vote accepted

The notary protocol includes both HTTP and HTTPS traffic: the HTTP part is used for the anonymous notary proxy.

share|improve this answer
So it doesn't matter if all the HTTP traffic goes through a HTTP proxy that can modify it's content? – LanceBaynes Jan 5 '12 at 12:18
On the one hand, if you believe the designers of a security protocol are capable of the sort of bone-headed mistake you are thinking of, then you shouldn't use it, whether they made such a mistake or not. – Graham Hill Jan 5 '12 at 16:10
On the other hand, they send the important stuff over HTTPS, and it's signed as well. – Graham Hill Jan 5 '12 at 16:15
And on the gripping hand, I haven't done a detailed analysis of the protocol (and am not really qualified to) - and certainly subverting the anonymous notary proxy scheme would be something of interest to an attacker. – Graham Hill Jan 5 '12 at 16:18
Having no real idea how notary services operate outside of base theory, but being a software dev: opening both HTTPS and HTTP would allow you to detect if there is proxy tampering going on, not sure if this is outside of the scope of their operation though. – StrangeWill Jan 5 '12 at 16:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.