Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

When searching on Google from a browser, the actual search query is visible in the address bar of the browser, even when using Google's secure search (https). Is there a way to submit the search query via POST instead of GET, so the query terms aren't visible in plain sight in the URL? This is to prevent snooping by network administrators.

share|improve this question

2 Answers

up vote 4 down vote accepted

There is no use to this. As you know, HTTPS prevents your network administrators (or anyone else in between you and Google's servers for that matter) to see the request (so the URL but also the POST data), unless the admins have monitoring software on your computer or make you use a proxy. If they do, they can also see what you are sending via POST. So I don't see a scenario where POST requests might be useful if you use HTTPS and simply delete your browsing history (you can set the browser to do that automatically when you close it).

It might be a little less obvious in logs or tools when you use POST requests, software might be meant for displaying URLs, but technically there is no difference. If you still want to use POST for some reason, I think you're going to have to use a proxy service for Google.

DuckDuckGo, a search engine focused on providing more privacy than Google, has the option to use POST requests instead. On duckduckgo.com/settings, go to the privacy tab, and there you can set whether the address bar shows your query. DDG has more advantages though, you should give them a try if you are concerned with privacy. There are also some tools for developers, like automatically searching popular programming language's documentation (e.g. /?q=strpos).

But then again, if your pc is bugged, they can see POST requests if they want to. If it's not, then HTTPS suffices.
And I also wouldn't recommend doing things you shouldn't do on other people's network. Sooner or later it'll be found out, and might get you in trouble.

share|improve this answer
Thanks, I had no idea that the URL was also encrypted for POST requests. Oh well, you learn something new every day I guess. I'm on a clean install of Linux Mint and I'm pretty sure no one has managed to install any monitoring stuff on it yet. Oh and it isn't that I am doing anything illegal, it is just that my workplace is a fairly small organization where everyone knows everyone by name, and I would like to keep my preferences private. DuckDuckGo is great, but I haven't found it very useful when searching for programming stuff. Thank you for taking the time to write a great answer. – Jeshurun Nov 1 '12 at 17:28
@Jeshurun Glad I could help! To continue about https a bit: it actually encrypts everything on the connection. No matter if it's GET, POST, PUT (you won see that a lot), or anything else that HTTP supports. It will encrypt the request (URL with headers - headers contain things like what browser you are using), any additional data like POST-data, the response headers, and the response content. Sometimes images or so will be loaded unsecurely and make it give a mixed-content warning, but the page itself (the HTML) will always be secure with HTTPS. So just using that you're probably good :) – Luc Nov 1 '12 at 17:35
Yep, I just stumbled on this and that cleared things up. I am quite familiar with PUTs and DELETEs actually :), as I do a lot of REST work, but somehow I was completely oblivious to the fact that URLs are encrypted as well on https connections. Thanks again! – Jeshurun Nov 1 '12 at 17:49
For this specific question using a POST request is pointless but there are cases where it improves security. GET URLs are kept in the browsers history and may be obtained at a later date. Obviously with a search query this makes no different - the history will contain the resulting page which will also contain the query. But in the case of credit card data (for example) this should stay in the POST request, even on HTTPS! – Andy Smith Nov 1 '12 at 18:19
@Luc HTTPS doesn't mean you're safe from ease dropping. Any good network administrator is going to monitor SSL connections. – ponsfonze Nov 2 '12 at 6:07
show 4 more comments
up vote 2 down vote

Was going to try show this with a wireshark capture but basically.

The entire request is encrypted, including the URL, and even the rest of the request including the GET parameters.

share|improve this answer
Thanks Mark, would have accepted your answer had you posted those screens :) – Jeshurun Nov 1 '12 at 17:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.