I was under the impression all images were https. Not really a computer person. So I don’t really understand how this works. I was also under the impression that isps can see all images and searches despite having https. Wouldn’t that be beneficial in some cases? I get nervous searching health info as I know google and isps can sell your info
I was under the impression all images were https.
This is not true. While the images shown in the Google Images Search are served by Google using https they can refer to images which are plain http, i.e. once you click the link you get the image as plain http.
I was also under the impression that isps can see all images and searches despite having https.
This is not true either. Unless SSL interception is done (which needs changes to your computer in order to be not cause warnings or errors) the ISP can see what sites you visit but not the exact content of the request or response, like which search terms and which results.
I get nervous searching health info as I know google and isps can sell your info
Google can definitely see your search terms given since otherwise they could not provide you with the results of your search.
ISPs can as I said not see the exact searches but they can detect the sites you visit and at which time and order. This is often enough to create interesting personal profiles which they could sell if there is no law or legal terms to forbid this. And even if laws prevent selling such information, the ISP might have its own advertisement business (like Google does) or even their own insurance business and might use these information there without selling it to third parties.
In a default architecture, an ISP cannot read your data for https website. However, there are few modifications that enabler attacker or legitimate ISP to view or sniff data. This includes performing man in the middle attack through SSL deciphering or performing less reliable attacks like sslStrip etc
If you want to be sure that your data is being viewed or not, please have a look at Certificate chain for the https website in browser.