[jbob2000]

Well if you put on your tinfoil hat - maybe someone wants to track who's viewing which patents, which they can't do when it's encrypted. You're right, it doesn't make any sense to do this, so there must be an ulterior motive.

[stonesam92]

If that were the case and USPTO were in on the trick, why the need to drop HTTPS?

They'd have that data already, so could just share it directly.

[mcbits]

This will allow ISPs to track who is viewing particular patents and when. That would be very lucrative data to sell in some circumstances. I doubt the USPTO would distribute a list of IP addresses that accessed a patent without some kind of due process.

[sgt101]

I think this might be gutted out already though as big companies use proprietary databases which have enhanced data on the patents. Also google patents...

[mcbits]

Yeah, I don't think it's actually their reason for the change. It's just one hypothetical consequence that the decision makers probably failed to consider. Still, the decision makers should be investigated for conflicts of interest because they've made a really fishy-smelling decision.

[dom0]

Didn't your country just drop the privacy protection rules that hindered ISPs from selling any American's browser history?

[ErikBjare]

If they shared the data, they could get caught doing so. By simply removing HTTPS someone could intercept the requests on their own without any wrongdoing on the part of USPTO (aside from dropping HTTPS).

[bcook]

Plausible deniability? Shifting blame?

I'm just playing Devil's advocate here.

[zkms]

> Well if you put on your tinfoil hat - maybe someone wants to track who's viewing which patents, which they can't do when it's encrypted.

No, a third-party attacker can just look at size/timing of packets to figure out which page is being viewed, especially given it's among a limited and static corpus.

[jagger27]

Tracking users over HTTPS is a solved problem, so I doubt that'd be it. Something about "never attribute to malice that which can be adequately explained by incompetence"?

[copperx]

What do you mean by that? Is knowing the URL of a HTTPS request a solved problem?

[jagger27]

What I mean is that if a third party wanted tracking info all they'd have to do is pay for a tracking script to be injected. Let's say the patent office is okay with this. Why wouldn't they just include a <script src="evil.js"> instead of going through the trouble of disabling HTTPS just so a third party can get their eyes on the juicy information? Just as easily, patent office could sell access logs to interested parties. In that not-very-roundabout way, knowing the URL and who wants it is very much a solved problem.

If third party tracking (for malicious intent or otherwise) is the main reason behind the change, why not do it how everyone else does?

It stands to reason they just don't want to deal with SSL termination anymore, for whatever reason. Though, at least in my eyes, that's a solved problem too.