With ISPs getting license to record and sell customer's traffic data, why doesn't Google switch to POST method for search queries to provide better security to the users, while HTTPS is already used?
ISPs will either be able to record/sell queries such as DNS, which leaks no information about content other than domain name.
If ISPs record traffic then POST/GET data is equally easy to capture. If the traffic is sent over HTTPS its equally as difficult to capture. The SSL/TLS tunnel is secure end-to-end regardless of the content being transferred.
The only way ISPs could see the secure communications is by man in the middling the traffic, such as getting you to install their own ROOT CA to allow them to proxy your communications. But again then they would see all POST/GETs anyway.
Yes, you are missing something. The HTTPS channel is openned first then the GET request is sent over the tunnel. It is not exposed at all.
Its like this: https://google.com/search?q=...
- get IP from hostname - its google.com (using DNS - this can be captured by ISP)
- check the protocol - its HTTPS
- Open encrypted channel and validate certificate - ISP knows you are connecting to google.com
- Send HTTP request over encrypted channel - Can't (or can be very hardly) captured by ISP as traffic is encrypted.
There is no way ISP can capture anything behind the https://google.com/... Everything in the HTTP protocol, including the request and headers is encrypted and it does not matter if it is get or post. the encryped data is:
GET /search?q=... HTTP/1.1 Host: google.com ....
in case of post:
POST /search HTTP/1.1 Host: google.com ... \n q=....