0

Hate to bring politics onto this site, but politics did inspire this question.

I found out today that Donald Trump's new executive order now allows ISP's to sell your data, browser history, and whatnot. However, is that even technically possible, for https sites?

The largest advertising network being Google Adsense is on https since a while ago, many others are too, but also everyone is soon going to shift to https as certificates are already free and easy to implement. So isn't his executive order (about to become) largely irrelevant?

Or is it actually possible, strictly technically speaking, for an ISP to read the information you exchange with a https site?

2
  • 2
    If you're talking about S.J.Res.34, that's not an executive order.
    – Ben Voigt
    Apr 25, 2017 at 1:54
  • 2
    Also, the rules didn't change (the privacy provisions never took effect), so it would be more accurate to say ISPs are allowed to continue selling the data. The law prevented a particular set of new restrictions from taking effect in the future.
    – Ben Voigt
    Apr 25, 2017 at 1:58

2 Answers 2

4

I agree for the most part with @DNUCKLES, except that your ISP can probably determine what you are viewing. HTTPS does not really provide privacy.

For example, in this paper the researchers sniffed Netflix traffic and determined what movie was being watched, just by looking at the size and timing of the traffic. In this paper, researchers could see what you typed in a search box by sniffing HTTPS traffic. This paper identifies which pages you visit on a medical site with 89% accuracy.

1
  • An example of where Big Data erodes privacy. Note that what the watcher (ISP or otherwise) can learn is from deduction and recognizing patterns rather than seeing the actual data covered by the encryption. They don't technically see what you're sending, but as far as your privacy is concerned it is the same thing - they still "know" what you're doing. See the report Digital records could expose intimate details and personality traits of millions.
    – user135823
    Apr 26, 2017 at 3:37
3

With a properly configured HTTPS website, your ISP cannot dissect your traffic and see what the packets contain. They can however see some metadata in regards to your traffic such as what IP address or websites you browse to, they just can't see exactly what you're doing on that website.

With news of the executive order, several notably adult content websites issued default HTTPS on their websites. Troy Hunt summarized it best by saying "Even with HTTPS your ISP knows you watch porn, how much you watch and when you watch, just not how weird it is". I think that tweet accurately describes how metadata can still be invasive even if you don't know the content of the exchange.

3
  • interesting. In my closed post, I was repeatedly told that my ISP does not do what you wrote in your answer that it does and I know it does. Furthermore, I was told a VPN does not help, against my own personal experience where I have done online shopping without a VPN and then found ads for what I had purchased on my other devices, or I could see ads for products my wife was purchasing when I never looked at them myself. Yet when we use Opera VPN, that nonsense stops.
    – Daniel
    Jan 2, 2021 at 0:38
  • here is the post: security.stackexchange.com/questions/242785/…
    – Daniel
    Jan 2, 2021 at 0:39
  • @Daniel nobody said that the ISP can't or doesn't do this; it's just not likely compared to the other hundreds of advertising parties that have a lot more information than your ISP. Jan 2, 2021 at 15:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .