Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

For example, say the following are HTTPS URLs to two websites by one IP over 5 mins: "A.com/1", "A.com/2", "A.com/3", "B.com/1", "B.com/2".

Would monitoring of packets reveal:

  • nothing,
  • reveal only the IP had visited "A.com" and "B.com" (meaning the DNS only),
  • reveal only the IP had visited "A.com/1" and "B.com/1" (the first HTTPS request for each site),
  • reveal a complete list of all HTTPS URLs visited,
  • only reveal IP's of "A.com" and "B.com",
  • or something else?

Related Question: can my company see what HTTPS sites I went to?

While this question does have additional information, it as far as I'm able to tell does not address specifically the scenario of "reveal only the IP had visited "A.com/1" and "B.com/1" (the first HTTPS request for each site)" - though possibility being wrong about this is high, and happy to delete the question if it's a duplicate.


NOTE: This is a followup question to an answer that was posted to as: Why is HTTPS not the default protocol?

share|improve this question

2 Answers 2

up vote 29 down vote accepted

TLS reveals to an eavesdropper the following information:

  • the site that you are contacting
  • the (possibly approximate) length of the rest of the URL
  • the (possibly approximate) length of the HTML of the page you visited (assuming it is not cached)
  • the (possibly approximate) number of other resources (e.g., images, iframes, CSS stylesheets, etc.) on the page that you visited (assuming they are not cached)
  • the time at which each packet is sent and each connection is initiated. (@nealmcb points out that the eavesdropper learns a lot about timing: the exact time each connection was initiated, the duration of the connection, the time each packet was sent and the time the response was sent, the time for the server to respond to each packet, etc.)

If you interact with a web site by clicking links in series, the eavesdropper can see each of these for each click on the web page. This information can be combined to try to infer what pages you are visiting.

Therefore, in your example, TLS reveals only A.com vs B.com, because in your example, the rest of the URL is the same length in all cases. However, your example was poorly chosen: it is not representative of typical practice on the web. Usually, URL lengths on a particular site vary, and thus reveal information about the URL that you are accessing. Moreover, page lengths and number of resources also vary, which reveals still more information.

There has been research suggesting that these leakages can reveal substantial information to eavesdroppers about what pages you are visiting. Therefore, you should not assume that TLS conceals which pages you are visiting from an eavesdropper. (I realize this is counterintuitive.)


Added: Here are citations to some research in the literature on traffic analysis of HTTPS:

share|improve this answer
1  
+1 @D.W.: Do have a link to the research you're referencing? Thanks! –  blunders Jun 7 '11 at 19:57
1  
Cheng&Avnur, 1998, Traffic Analysis of SSL Encrypted Web Browsing‌​. Google Scholar is very good at finding reasach papers, it was the first hit. –  Hendrik Brummermann Jun 7 '11 at 21:58
1  
@blunders, good suggestion. I've added a bunch of links. As you can see, this has been studied in quite some detail in the research literature. –  D.W. Jun 8 '11 at 2:12
    
+1 @D.W.: Selected your post as the answer. To me, the n-gram block attack on AJAX-based HTTPS transactions is not surprising if you generalize the threats presented, though agree that it clearly high-lights how serious the issue might be in some cases. Thanks for posting the links, really improved the quality of your answer in my opinion. Cheers! –  blunders Jun 8 '11 at 3:22
    
+1 @Hendrik Brummermann: Thanks, spot on for suggesting Google Scholar! –  blunders Jun 8 '11 at 3:28

The second choice. Mostly.

When a browser visits a HTTPS web site, it establishes a TLS tunnel, which involves an asymmetric key exchange (client and server agree on a shared secret). That key exchange mechanism uses the server public key, which the server shows as part of his certificate. The server certificate contains the server name (e.g. A.com) and the client verifies that the name matches the one it expects (i.e. the server name in the URL). The server certificate is sent, fatally, before the key exchange, hence in plain view.

The rest of the URL is sent as part of the HTTP request which occurs within the encrypted tunnel, hence invisible to third parties. A given tunnel may be reused for several other HTTP requests, but (by construction) they are all for the same server (the same domain name).

share|improve this answer
    
+1 @Thomas Pornin: Great, thanks, answers my question. –  blunders Jun 6 '11 at 13:14
5  
I think this might be the first time I've seen @Thomas's answer be anything less than perfect. But in this case, it fails to mention the fact that HTTPS leaks various kinds of length information, which can potentially reveal which page (not just which site) you visited. See my answer for more. –  D.W. Jun 7 '11 at 19:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.