I always thought the images from Google image search were under the domain of Google URLs.

As long as you don’t click the image to visit the original site that hosts that picture, you were with Google all along.

Clearly I was wrong! I discovered even you just clicked to preview the enlarge version of your searched images on Google (without being redirected to the 3rd party side)

The DNS request in your traffic were already outside of the Google’s Domain! So your ISP can know the source domain of the image you clicked to preview on Google! However, the URL bar still displays as if you were with Google.

Then what’s the use of HTTPS then? It doesn’t protect you based on its purpose, is it?

If someone has serious medical condition and he searched and previewed the images of that medical condition on google. These DNS requests will expose to the ISP that this user viewed a pic originated from www.seriousillness.com, but not with www.google.com.

How could this user protect their privacy?

I am very disappointed about Google claiming they are secure.

  • 5
    I think you are missing a basic understanding of how the web work, i.e. that a site can embed resources (images, videos, styles, fonts, script...) from other sites, no matter if HTTP or HTTPS. Thus most of the advertisement you see is embedded from other sites as is most of the interactions with Facebook, Twitter etc you'll find included on many sites. And Google image search is no exception to this. HTTPS only means secure transport, i.e. no sniffing and modification of content. HTTPS does not mean privacy from sniffing meta data like source or destination or size of data. – Steffen Ullrich Dec 14 '17 at 19:09
  • 3
    Hi OP, I'd recommend that you rephrase this as some type of question within the scope of Stack Overflow, so that we can better respond to this post. As it stands, this is just a rant about how you can't use google to perform reconnaissance without your ISP seeing any of it. – Adonalsium Dec 14 '17 at 19:15
  • 1
    @Adonalsium we are on Information Security :-) -- but still: your recommendation is very valid. – guntbert Dec 14 '17 at 19:46
  • Curse these fat fingers. – Adonalsium Dec 14 '17 at 21:13
  • 1
    @Oplsks: in this comment you ask a very different question from your original post. But, comments are not intended to ask new questions. Therefore please do a new post with a new and well formulated question. But before that please have a look at existing questions because there are already lots of questions here about which technologies are usable for better privacy and their limits. It would be bad if your new question would be closed quickly since it is considered to similar to existing questions. – Steffen Ullrich Dec 15 '17 at 3:46

Then what’s the use of HTTPs then? It doesn’t protect you based on its purpose, is it?

The purpose of HTTPS is to protect the content of your communication, which in this case is everything that is sent as part of the HTTP request: the content and HTTP headers. (Another purpose of HTTPS is to verify the authenticity of the site you're communicating with).

However, HTTPS does not protect the DNS lookup, which happens outside of HTTP.

Nor can it hide the IP address of the site you're communicating with, which is a lower level of the Internet communication.

An observer able to view network traffic could access the IP address of the sites you communicate with, and in most cases the hostnames, but not the full URLs or content.

How could this user protect his/her privacy?

If you are accessing the internet from an untrusted/hostile network you can use a VPN. A VPN encapsulates and encrypts all Internet communication, including the IP addresses of the servers you're communicating with and all protocols including DNS.

I am very disappointed about google claiming they are secure.

This is not related to Google in any way.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.