Ask HN: Is RESTful style URL against privacy?
I have a question around privacy, want to see your guys thoughts, so the industry has been pushing for RESTful style of URL for maybe a decade now, but isn’t RESTful a bit against privacy? I mean if I use a DNS I cannot trust, then they can simply record every url I visit and based on the url they can figure out a lot about me? A very intuitive example would be say if I click by accident on some NSFW subreddit's link, then the DNS provider can detect that and think I am browsing that on purpose. In that case isn't an obfused URL better?
2 comments
Full URL: https://example.com/path/document.html
DNS providers resolve the host name only (example.com => (93.184.216.34), it doesn't see the rest of the URL (path, parameters).
Do you mean ISP (your internet service provider)? With HTTPS the connection to the website is encrypted. The ISP can only see that you connect to the domain name, not the path or parameters. With unencrypted HTTP they'd be able to see the full URL.
> In that case isn't an obfused URL better?
As long as the connection is encrypted (https://...) it should be fine. Obfuscated URLs would help you when you worry that somebody is accessing your browser cache, bookmarks or a browser plugin sending URL to a third-party.
DNS providers resolve the host name only (example.com => (93.184.216.34), it doesn't see the rest of the URL (path, parameters).
Do you mean ISP (your internet service provider)? With HTTPS the connection to the website is encrypted. The ISP can only see that you connect to the domain name, not the path or parameters. With unencrypted HTTP they'd be able to see the full URL.
> In that case isn't an obfused URL better?
As long as the connection is encrypted (https://...) it should be fine. Obfuscated URLs would help you when you worry that somebody is accessing your browser cache, bookmarks or a browser plugin sending URL to a third-party.
Doesn't the DNS only see the domain name? The browser doesn't send it the full URL.