https://hackerpaper.kaipfister.de/p/1602.07128/Collected HN comments and submissions linking this paper.enMon, 02 Nov 2026 11:16:22 GMThttps://news.ycombinator.com/item?id=13440291urn:hackerpapers:mention:1602.07128:13440291Thu, 19 Jan 2017 23:03:41 GMT<p>Yes, I do know that hostnames are typically outside the HTTPS envelope. However, user-agent is not, and would be exposed (and could then possibly be correlated to other HTTPS traffic from the same IP address). Also, potentially cookies from a previous session -- even a previous HTTPS session -- could be exposed, depending on how careless the server operator is. (You can set flags to make sure cookies only go over HTTPS, but that doesn&#x27;t always happen.) From an integrity perspective, connecting to alerts.fema.gov over HTTP does potentially subject the user to code injection attacks. Those do…</p><p><a href="https://hackerpaper.kaipfister.de/p/1602.07128/">Paper and discussion history</a>. A mention is not an endorsement.</p>cs.CRhttps://news.ycombinator.com/item?id=11169526urn:hackerpapers:submission:1602.07128:11169526Wed, 24 Feb 2016 19:34:15 GMT<p>Website-Targeted False Content Injection by Network Operators</p><p></p><p>46 points; 9 discussion replies on HN. <a href="https://hackerpaper.kaipfister.de/p/1602.07128/">Paper and source history</a>. A submission is not an endorsement.</p>cs.CR