I found that my internet service provider uses a transparent proxy on some sites and apps like Google, Whatsapp, etc. I know they use it to save bandwidth but my question here is if they are able to spy easily or not?

  • 4
    have you done any reading on the topic?
    – schroeder
    Commented Oct 8, 2015 at 4:35
  • 6
    I would even dare to ask: do you understand what a proxy is ?
    – Stephane
    Commented Oct 8, 2015 at 7:24
  • @Stephane short answer proxy methodology take your requests and give it to destination and vice versa "thank you"
    – MR Robot
    Commented Oct 9, 2015 at 0:21
  • Your ISP doesn't need transparent proxies for spying on you.
    – Baptiste
    Commented Sep 26, 2017 at 0:26

1 Answer 1


If HTTP is used, yes they can spy on you. If HTTPS is used, no they will not be able to spy on you. The transparent proxy is normally run on port 80 (HTTP) only, since it does not work with HTTPS.

The transparent proxy only caches content which is common to most users. e.g. logo.png, favicon.ico. Since every user is going to load the same site logo, it is a waste of bandwidth to download it from Google/Whatsapp repeatedly. Websites usually use headers to indicate that the content is "cache-able". Cache-Control: max-age=3600 indicates that the content is valid for 1 hour, hence your ISP only needs to retrieve the latest copy once every hour.

However, your personal mailbox or conversation list will never be cached. This is because it is unique to you, so there is no benefit from caching it. Hence, websites normally do not add cache headers to the response. If the website uses POST to retrieve this data, according to HTTP 1.1 RFC 2616 S. 13.10, the cache should be invalidated. If the website uses GET request, the URL is likely to be unique, e.g. http://example.com/getmessage.php?uid=123456, since every user has a different UID, it is pointless to cache such responses.

  • technically they could use SSL bump ... I have used it when creating squid proxy systems. If you wanted to you could spy on SSL traffic though it would be very difficult to do so without the users knowing, but not impossible.
    – TheHidden
    Commented Oct 8, 2015 at 10:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .