Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I own a private business and a web site with a domain name hosted with Godaddy US. I live in Europe. I want to know if the various ISP of my customers in my country can find out who visited my web site (by seeing which user IP visited my website's IP). My web site has an SSL certificate, HTTPS, therefore static IP.

My concern is if people from these ISPs find out who visits my web site and provide this info to my business competitors. I do not know if it happens, I want to avoid this possibility. How can I achieve this?

share|improve this question

3 Answers 3

Yes they can. If they are logging all outgoing connections (as for instance Turkish or Chinese ISPs tend to do) then they can easily correlate locally used IPs to your website.

SSL works at higher level of the internet stack. Furthermore even if you would obfuscate your IP address they would still see your customers DNS requests passing by. There is no way to obfuscate this unless all your customers start using Tor or another VPN solution which is not transparent to their ISPs.

share|improve this answer
    
thank you very much. If they log DNS requests then my idea of removing my SSL cert, then shifting from https to http ( therefore my web site to have dynamic ip with godaddy ) would not help. Any chance you know if also is the same case with e-mails ? customers emails, in metadata, bear the name of my domain also when they reply to myemails. I use hushmail business and in metadata it shows hushmail servers ip. So in my emails with hushmail ip & my company domain name existent, this would be like a beacon for the isps in my country to trace and read my emails if they want , right ? –  Guestseekinganswers Dec 2 '13 at 20:56
    
You are correct. –  Lucas Kauffman Dec 2 '13 at 21:30
    
Sincere thanks. It is a nightmare, I have to find alternative forms of communication with my customers or limit email as much as possible. Business communication where everything is open to possible competitors is simply a business danger. Is better I start a new topic regarding email alternatives or email security practice on this forum. Again thank you. –  Guestseekinganswers Dec 2 '13 at 22:08
    
@LucasKauffman, can you elaborate more on "Turkish ISPs tend to log outgoing connection"? As EU citizen living in Turkey I'm paranoiac for my privacy. As far as I know there is law that prohibits such kind of activities in Turkey. –  ilhan Dec 3 '13 at 12:38
1  
In practice you will notice that Turkey logs a lot (or at least has the ability) information as all traffic needs to pass government regulated firewalls. –  Lucas Kauffman Dec 3 '13 at 12:44

Yes, ISPs can see which domains their customers are browsing, and when they are in Europe, they even have to do it.

The data retention directive of the European Union forces all European ISPs to log all the connections of their users for at least six months for law enforcement purposes. Most European countries have already ratified and executed this directive. A notable exception is Germany where public protest and a constitutional complaint prevented it from happening till now, but the newly elected government has already announced that they intend to go through with it in this legislation period.

But your fear that the ISPs might sell this information to your competitors is likely unfounded, because EU privacy laws prohibit them from accessing that data without a court order. That means as long as your users activity on your website doesn't conflict with the law, the ISPs should (should!) keep their users connection data confidential.

By the way: Next year the European parliament will be re-elected. There are parties which want to get rid of this directive and others who support it. It's your choice which one you want to vote for. (Full disclosure: I am a member of a party which wants to get rid of it).

share|improve this answer
    
Philipp, thank y. I didnt know that. Data retention: I am in favor of authorities hunting down criminals. I am against corrupted officials selling info to business. Court order: In my country, few hundred Euros can make miracles without need of court orders. This topic is large I can say more but this forum demands technical questions. For me to avoid possible ISP snooping I need maybe a remailer, or smtp services, but long metadata and different ips may send my emails to the spam folder of my customers, more over when they reply, message must come to me, without my domain name on it –  Guestseekinganswers Dec 5 '13 at 22:34
    
@Guestseekinganswers Then you should maybe search for a communication channel which isn't as broken as email. Requirements: Anonymous but reliable and user-friendly. That's stuff for a different question, though. –  Philipp Dec 6 '13 at 10:42

It is question of convenience vs privacy (as it very often happens in security).

If you need higher degree of privacy for your clients you can move your server to the Tor network, hiding it behind the onion routing. See: Hidden Services

The problem is, that your customers will need to install Tor and I don't know if they care enough to do this. It is quite easy, but still…

share|improve this answer
    
correct, is a problem. Assuming I convince selected customers use Tor ( difficult but not impossible ) but purchasing managers ( employees ) would not dare even if they wanted so ( possible objections by IT administrators ) . Regretfully owners and employees do not use encryption –  Guestseekinganswers Dec 6 '13 at 13:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.