0

I am a novice about digital things (imagine the antonym for "tech savvy").

  1. Can my ISP know my yahoo email address? I have signed in on yahoo more than a million times. Yahoo is https.

  2. Can my ISP know my Yahoo password?

  3. Can my ISP know my Amazon.in (India) account email and password? There are Indian alternatives to Amazon: Flipkart.com, Snapdeal.com, Infibeam.com Can they (my ISP) figure out by any means about my email and password on these Indian shopping websites? All websites mentioned are https.

  4. Those shopping websites obviously require me to enter my physical address, the place where I live. Can my ISP know where I live, by this way, that is through these websites? They are all https, just to remind.

  5. Can my ISP know my purchases on these websites?

  6. Can my ISP know which video I watch on YouTube? [https]

  7. And finally, can my ISP know which video I watch on PornHub? (again, https)

  8. Imagine someone searching about "how to spread terror-" sort of things. If the Govt. directs ISPs to find such people. How could the ISP find such people?

I am afraid I will not like even my ISP to know where I live or what I purchase. It is so fearful to know that they do keep such information about us. The first time discovered it, I couldn't believe my eyes.

Could anyone please help me know the details/mechanisms behind this? I am willing to learn even if I am not a computer-savvy person.

PS: One of the sites that I found useful is this but I don't know how accurate it is.

10
  • 1
    This is arguably too broad. HTTPS if properly done protects the content of the session (so user names, email addresses, passwords, individual pages visited, etc) but DNS is typically unencrypted so unless you are using DNSSEC (pro tip: you're not) your ISP can see what domains your computer is looking up when you are about to connect to their site.
    – tripleee
    Nov 4 '20 at 12:17
  • @tripleee Thank you for your comment. Although I don't know much about DNSSEC, I just want to tell that I don't mind if my ISP sees what website I am on, say Yahoo, YouTube, or even PornHub. I don't mind. But do they know my physical address (via Amazon.in), the actual content I watch on YouTube or PornHub? That is my question. I am not a computer person, just an ordinary common man:) I am assuming "domain" is a "website" like the domain of this website is security.stackexchange.com. Is this true?
    – Jay Shah
    Nov 4 '20 at 12:30
  • Strictly speaking "com" is a top-level domain and "stackexchange.com" is a domain, and "security.stackexchange.com" is a host (or server, or node) within this domain. In informal speech "domain" usually refers to the middle level, i.e. an organization running one or more web sites.
    – tripleee
    Nov 4 '20 at 12:37
  • 1
    Your ISP already knows your physical address; that's where they send their bill. If you have a different address which you only use over encrypted sessions (HTTPS) they can't see that.
    – tripleee
    Nov 4 '20 at 12:38
  • @tripleee Thanks. So if I am here typing on the URL security.stackexchange.com/questions/240416/…, what information does ISP have?
    – Jay Shah
    Nov 4 '20 at 12:38
2

(1) Can my ISP know my yahoo email address? I have signed in on yahoo more than a million times. Yahoo is https.

(2) Can my ISP know my Yahoo password?

(3) Can my ISP know my Amazon.in (India) account email and password? There are Indian alternatives to Amazon: Flipkart.com, Snapdeal.com, Infibeam.com Can they (my ISP) figure out by any means about my email and password on these Indian shopping websites? All websites mentioned are https.

(5) Can my ISP know my purchases on these websites?

(6) Can my ISP know which video I watch on YouTube? [https]

(7) And finally, can my ISP know which video I watch on PornHub? (again, https)

No, unless you tell them. Your ISP knows which sites you navigate (and a lot you don't, but are referenced on the pages you view: images, scripts, things like that). That's why some people tell you to use a VPN to protect your privacy against your ISP.

Those days, the vast majority of traffic are protected by HTTPS, so the ISP have no much knowledge on anything you do, except for the metadata: which site it is, how many times you connect, how much traffic is involved. And the name of every site because the plain old DNS you are using is not encrypted.

DNS is the protocol used for finding the IP address for a domain name (like www.wikipedia.org, for example, is 208.80.154.224 from where I live). The DNS request is sent on clear, so even if you don't use your ISP DNS server, they can see the request, and even intercept it and respond themselves.

Using DNS-over-TLS or DNS-over-HTTPS mitigates this privacy leaks because now the ISP won't have the domain you are visiting, but only the IP address. It's possible that more than one site uses the same IP address, so in some cases, it's not possible to say for sure that you are visiting site-a.com when site-b.com shares the same IP. And high-traffic sites usually employ a CDN (content delivery network) to distribute traffic, and the IP they use are not the site's IP, but an IP belonging to the CDN (like CloudFlare or Akamai).

They cannot tell which video you watch on YouTube or PornHub, but they can tell you are on YouTube, PornHub, and have a good estimate of how much time you spend on each one.

(4) Those shopping websites obviously require me to enter my physical address, the place where I live. Can my ISP know where I live, by this way, that is through these websites? They are all https, just to remind.

They know, but not by decrypting traffic. If the connection is fixed (ADSL, fibre, phone line, long range wifi) they must know where you live so they can install the cable or receiver. If it's cellphone service (4g, 3g), they can track your position in realtime. And the contract you sign must have your address too, and it's not a good idea to lie on a contract.

1
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Rory Alsop
    Nov 7 '20 at 12:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.