0

So with https, someone can still see what website I visited, but not which pages within that website I visited, correct?

  • why isn’t the whole process of connecting to a website - from when I start typing the website name on the browser - encrypted?

Is there a protocol/technology that actually provides encryption for that initial connection?

From what I understand a VPN can encrypt the websites I visit from the initial connection - but then someone can see that I logged onto a VPN and I’m back to square one, correct?

I’m trying to understand this from a layman’s POV : If I am trying to not rise my suspicion at all that I’m visiting websites I’m not allowed to - what is the process for that? I’m not talking about being secure after raising suspicion - more about avoiding initial suspicion.

Improve this question
2
  • 1
    Suspected by whom? The answer to that is important.
    – schroeder ♦
    Sep 29, 2020 at 15:08
  • 1
    @schroeder someone that can pressure a local ISP, for example : a government.
    – nicotinefull
    Sep 29, 2020 at 16:06

3 Answers 3

Reset to default
4

So with https, someone can still see what website I visited, but not which pages within that website I visited, correct?

Kind of. HTTPS is build on top of TLS. Within the TLS handshake the client announces to the server which domain it wants to access. This is needed since there can be several domains with their own certificates on the same server IP address and the server need to decide which certificate to provide to the client.

This server name is traditionally included as a plainly visible SNI (Server Name Indication) extension in the the TLS handshake, so that it can be extracted with passive sniffing. Additionally up to TLS 1.2 the certificates from the server were send in plain too. Since the certificates also contain the server name they could also be used to gain information. With TLS 1.3 the certificates are encrypted though.

Note that all HTTP application data are encrypted from start, which means that neither the full URL nor any other content can be sniffed by a passive attacker.

Is there a protocol/technology that actually provides encryption for that initial connection?

Encrypted SNI makes it possible to encrypt the SNI too. Unfortunately to encrypt the SNI there has to be some encryption key unknown to the attacker first. This is done (among other things) with the help of asymmetric cryptography, where the public key of the domain is located in the DNS. Only the server with access to the matching private key can decrypt the ESNI then, the attacker can't.

Of course, the attacker could still sniff the DNS requests to find out which domains the client looks up and which IP these return and then match these information to find the accessed domain name. Encrypting DNS helps here too, i.e. DNS over HTTPS (DoH) or DNS over TLS (DoT). Still, the attacker might reverse the IP to the domain name with other methods unless there are many different domains behind a certain IP. The latter is usually the case with Content Delivery Networks (CDN) and for small web sites on a bigger hosting provider, but is often not the case with larger web sites.

To close the gap of the attacker knowing the target IP address one has to use a VPN to protect the part of the connection where one suspects the attacker will sniff (i.e. typically local Hotspot or maybe nosy ISP or government). The VPN provider will of course still see the real target IP since otherwise it could not forward the traffic to the target.

Improve this answer
4
  • So when you say with HTTP the full URL is encrypted from the start and therefore can’t be sniffed by a passive sniffer - would that defeat, for example: a government mandated blacklist of sites designed to automatically trigger an alarm if someone tries to access it? Also, extra thanks for mentioning CDN - I thought IP addresses/ DNS querying has a 1:1 mapping with a site name which is where the crux of my question is. I’ll learn more about CDNs.
    – nicotinefull
    Sep 29, 2020 at 17:04
  • @nicotinefull: While the full URL inside the HTTP request is encrypted because they are application data, most SNI is still not encrypted which still exposes the domain part of the URL. With ESNI this gets encrypted too which makes it much harder or impossible to selectively block domains without negative side effects (i.e. blocking everything on the same IP address). That's why you see China and Russia block or ban traffic with ESNI - since ESNI means that they loose control.
    – Steffen Ullrich
    Sep 29, 2020 at 17:18
  • Great thanks - I was getting to Russia/China - just to clarify the part where you say “with ESNI they lose control” - do you mean they lose control over more sophisticated control and have to use blanket censorship as in : instead of blocking “Democracy” on google they have to block ALL of google - or did you men something else?
    – nicotinefull
    Sep 29, 2020 at 17:39
  • @nicotinefull: With plain SNI it is still possible to block by domain name. With ESNI this domain name is no longer visible and one can only block by IP. But blocking the whole IP address also affects any other domains on the same IP which might be an unwanted side effect. Blocking any kind of ESNI essentially adds pressure on the CDN or hosting provider, that if they want to get access to the hosted domains back they have to disable ESNI for these, i.e. remove the related DNS records with the public key.
    – Steffen Ullrich
    Sep 29, 2020 at 17:45
4

You are confusing "confidentiality" with "anonymity". Encryption makes it so that the content of your communication cannot be known (confidentiality). But it does not hide who you are communicating with.

So, encryption is not the tool you need to use.

You are looking for some way for your traffic to be obscured. A VPN and Tor can do that, but then you say that you also want the fact that you are using an anonymising tool to be hidden. And that gets tricky since you need to rely on the Internet to pass your traffic to your destination. You have to expose your traffic to some degree.

That's when you use a proxy. And the best case is when the proxy is something innocuous, like a legitimate website that has a proxy backdoor. Then your traffic is going to this legitimate website, but it sends your traffic onwards to its final destination.

Improve this answer
3
  • Right - I’m talking about a situation where who you are talking to is enough to raise suspicion for you to begin being actively monitored, regardless of the content. So anonymity comes first.
    – nicotinefull
    Sep 29, 2020 at 16:50
  • Hi Nice answer! I have a similar concern. I searched here and this is the closest question. I would be glad if you can comment. Occasionally I use web-proxy servers I find from a list such as [this]([email protected]). The fact is, most web-proxies I find have red-crossed-unlock signs (connection not seure). Does that mean that all the data through such a web-proxy is un-encrypted and thus visible to anyone, including my ISP. They won't know which page I connect, but they can know which data I send or receive? right? Then using such a proxy is worse than not using at all (wrt ISP monitoring)
    – Fat32
    Jan 5, 2021 at 1:40
  • @Fat32 Yes, that icon means there is no encryption. If you click on it, it should explain that
    – schroeder ♦
    Jan 5, 2021 at 8:17
0

"why isn’t the whole process of connecting to a website - from when I start typing the website name on the browser - encrypted?"

Because the server and browser need to exchange the same decryption key so that only they can decrypt the traffic.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .