I always thought the images from Google image search were under the domain of Google URLs.
As long as you don’t click the image to visit the original site that hosts that picture, you were with Google all along.
Clearly I was wrong! I discovered even you just clicked to preview the enlarge version of your searched images on Google (without being redirected to the 3rd party side)
The DNS request in your traffic were already outside of the Google’s Domain! So your ISP can know the source domain of the image you clicked to preview on Google! However, the URL bar still displays as if you were with Google.
Then what’s the use of HTTPS then? It doesn’t protect you based on its purpose, is it?
If someone has serious medical condition and he searched and previewed the images of that medical condition on google. These DNS requests will expose to the ISP that this user viewed a pic originated from www.seriousillness.com, but not with www.google.com.
How could this user protect their privacy?
I am very disappointed about Google claiming they are secure.