1

I only use https websites and Microsoft Edge. I know that my ISP can see only https://example.com of the full URL I've visited (e.g. https://example.com/abc/xyz).

But I don't clear my browsing history or cookies from my browser. So:

  1. Can my ISP access the browsing history of my browser and know the visited websites' full URL?

  2. Can my ISP access my browser cookies and use that to log in to my accounts in forums or any websites?

3
  • When you load a URL over the HTTP protocol it uses TCP, this is commonly known as a handshake. When this is happening the browser checks for a certificate that is sent from the server to the client. This certificate is sent in the clear, so the domain is not hidden. If example.com has a different IP to example.com/abc/xyz, then there will be a new TCP handshake and the URL for this will not be hidden from the ISP either. There's a lot of websites out there that have multiple IPs for the same domain.
    – Coderxyz
    Oct 18, 2022 at 21:23
  • @Coderxyz: this does not happen during the TCP session establishment, but after. Also, TCP is not known as a handshake, but it does rely on a three-way handshake to establish the session.
    – Yuriko
    Oct 19, 2022 at 6:13
  • @Yuriko the connection needs to be established first yes, there is slight mistake in above explanation, the certificate is checked after the connection has been established. However, that didn't change the main point that domains with multiple servers or content handled on another domains, can have multiple certificates.
    – Coderxyz
    Nov 9, 2022 at 20:58

1 Answer 1

1

With the assumption that all connections are done over HTTPS:

  1. Your ISP cannot access the browsing history of your browser, this is a cache that is locally managed in your endpoints (smartphone, desktop computer, etc.)
    However, your ISP will be able to access the list of domain names or IP addresses you visited, as you said in your post. They will know you visited example.com, but not the content you accessed on the website.

  2. Your ISP cannot access the cookies transmitted, because they are also in the encrypted part.

If you browse the internet without protecting the communication with TLS (the S in HTTPS), then your ISP - and anyone that can listen to your communication - would be able to list all the website your visited (the complete URL) along with accessing all the cookies transmitted during the time they eavesdropped.

9
  • Thank you very much. much appreciated.
    – Ezio
    Oct 18, 2022 at 13:42
  • They might know what content was accessed if that content is hosted on a different IP address.
    – Coderxyz
    Oct 18, 2022 at 21:39
  • @Coderxyz: nothing changes however. If part of a content is hosted on a different server and retrieved using HTTPS, the ISP will only be able to have the domain name or IP address.
    – Yuriko
    Oct 19, 2022 at 6:09
  • @Yuriko Yes is does change, a new certificate is generated each time the IP you connect to does if the link on the site is hosted on a different server, even if the domain doesn't change. Lots of larger companies have different parts of websites hosted on other servers. They won't all share a certificate.
    – Coderxyz
    Oct 23, 2022 at 12:43
  • @Yuriko I would recommend looking at LawrenceC answering this. The top answer on here superuser.com/questions/916741/…
    – Coderxyz
    Oct 23, 2022 at 12:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .