[ViVr]

HTTPS improves security even for a static site because it prevents an ISP or middleman from injecting ads (or worse) into the page.

It also increases privacy because the contents of the traffic can not be observed by third parties.

[marpstar]

Right, but for a static site that’s publicly accessible, even HTTPS leaks the requested URL, any listener can go fetch that page themselves to see the contents.

[snowwrestler]

HTTPS does not leak the requested URL to servers between the client and the server.

[dmitrygr]

> even HTTPS leaks the requested URL

It does not. In the olden days the host name was leaked, but with SNI even that is gone. Anything past the first "/" is never and was never sent in plaintext in HTTPS

[cperciva]

Most public web sites leak information about page accesses to anyone who can count bytes.

[teaearlgraycold]

What kind of attack are you describing?

[cperciva]

Count how many bytes of TCP traffic you see. Measure the size of each web page on the (public static) website.

[fmajid]

The host name is still leaked, SNI is not encrypted and ESNI is still not mandatory in TLS 1.3.

[2h]

> host name was leaked, but with SNI even that is gone

nope, you can still see it perfectly fine:

https://tlshello.agwa.name/

please don't spread misinformation.

[dmitrygr]

ESNI*

[2h]

OK, now name at least two public servers that use that. I will wait...