1

Hate to bring politics onto this site, but politics did inspire this question.

I found out today that Donald Trump's new executive order now allows ISP's to sell your data, browser history, and whatnot. However, is that even technically possible, for https sites?

The largest advertising network being Google Adsense is on https since a while ago, many others are too, but also everyone is soon going to shift to https as certificates are already free and easy to implement. So isn't his executive order (about to become) largely irrelevant?

Or is it actually possible, strictly technically speaking, for an ISP to read the information you exchange with a https site?

  • 2
    If you're talking about S.J.Res.34, that's not an executive order. – Ben Voigt Apr 25 '17 at 1:54
  • 2
    Also, the rules didn't change (the privacy provisions never took effect), so it would be more accurate to say ISPs are allowed to continue selling the data. The law prevented a particular set of new restrictions from taking effect in the future. – Ben Voigt Apr 25 '17 at 1:58
4

With a properly configured HTTPS website, your ISP cannot dissect your traffic and see what the packets contain. They can however see some metadata in regards to your traffic such as what IP address or websites you browse to, they just can't see exactly what you're doing on that website.

With news of the executive order, several notably adult content websites issued default HTTPS on their websites. Troy Hunt summarized it best by saying "Even with HTTPS your ISP knows you watch porn, how much you watch and when you watch, just not how weird it is". I think that tweet accurately describes how metadata can still be invasive even if you don't know the content of the exchange.

3

I agree for the most part with @DNUCKLES, except that your ISP can probably determine what you are viewing. HTTPS does not really provide privacy.

For example, in this paper the researchers sniffed Netflix traffic and determined what movie was being watched, just by looking at the size and timing of the traffic. In this paper, researchers could see what you typed in a search box by sniffing HTTPS traffic. This paper identifies which pages you visit on a medical site with 89% accuracy.

  • An example of where Big Data erodes privacy. Note that what the watcher (ISP or otherwise) can learn is from deduction and recognizing patterns rather than seeing the actual data covered by the encryption. They don't technically see what you're sending, but as far as your privacy is concerned it is the same thing - they still "know" what you're doing. See the report Digital records could expose intimate details and personality traits of millions. – Gypsy Spellweaver Apr 26 '17 at 3:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.