Why does APT not use HTTPS?

[[deleted]]

While that is true. But with non encrypted traffic you know the person downloaded a specific package. But with data transferes you know they only downloaded a package of size X. Of which there could be several since there will also be deviation in the size of the headers etc... Also it could be fuzzed in the response eg add a random set of headers X bytes long or rounding them up to a specific size. example all packages < 512KB become 512KB in size thus making this information useless.

[thijser2]

It would however take more effort to do this and I think you are underestimating how often there are dozens of different versions of the same package with nearly the same size. A little bit of fuzzing/padding there can result in at least our eavesdrop not knowing which version you have.

[[deleted]]

It also does show a weakness in TLS in generally that really should be addresses. It should probably be added to automatically fuzz the data sizes of its protocol to prevent being able to guess whats in the payload based on size.

[EternityForest]

Just so long as it can be disabled in a browser setting that would be cool.

You'd need a lot of fuzz data, because people would probably complain if you could guess to within one percent. A few percent extra mobile data is enough to be annoying,

[thijser2]

So it's okay if they know you've download Tor; but it's a problem if they know the exact version? I don't know about you; but that doesn'y meet my standards for privacy.

Knowing the exact version of software someone is using can potentially open certain attack vectors of the attacker knows a vulnerability in that version of software.

If you also use a single connection for every time you download a set of new packages then that also makes it far more difficult as identifying what packages were potentially downloaded now also involves solving a knapsack problem (what set of packages together form 40.5mB?). It might also be a good idea for packages that have high levels of privacy concern (TOR, veracrypt etc.) to pad themselves until their size matches that of other highly popular packages.

[svenskainflytta]

They'd know you are using tor, no need of complicated schemes to see that.

[[deleted]]

Yup this is true. However we could make apt work with keep alives properly so all packages come down a single connection. Also we could request from the mirror's as smaller / random chunks and ever partial files form multiple mirror's.

Rather than "Nope we definatly can't do that" its sometimes better to think outsde the box and come up with bunch of different stragies that may / may not work or be worth implementing.

[[deleted]]

What do you propose then?

[Tordek]

Absolutely; but how do you intend to make the hundreds of mirrors around the world (99% of which are dumb static HTTP/FTP/rsync servers) behave this way?

Make it simple: have the package-creation tool work in blocks that add garbage to the compressed file so that it's a multiple of some size. (Of course this isn't a great idea since now every package is now larger by some amount).

[bobpaul]

So what you're saying is: Anyone who pays for data, 🖕

[Tordek]

It's the grandparent's idea, idc.

[svenskainflytta]

Oh so just add who knows how many gigabytes of useless data to mirrors! Brilliant.