Doesn't it make any difference if the sites we visit are not the standard ports like 80/443? Say we visit https://example.com:554/is-this-visible-to-isp? since domain is known to the ISP, what about the ports and the paths connected to the domain?
-
I've reduced your question to asking about using non-standard ports, since this is what makes it different from similar questions asked here.– Steffen UllrichJun 13 at 19:36
-
yes. Thank you. Can we have the following part: what we can do to share less information?– MaxfieldJun 13 at 19:38
-
This is no different from the TLS questions about paths.– schroeder ♦Jun 13 at 19:39
-
I've removed the part about what webmasters and users can do about it - these are different question and also not covered from the title. Please ask these as separate questions if you don't find it already asked before.– Steffen UllrichJun 13 at 19:44
Add a comment
|
3 Answers
The domain can be hidden in TLS 1.3, even if this isn't currently supported in all browsers. TLS uses the Server Name Indication (SNI) extension to specify the hostname it wants to connect to. In TLS 1.3, there's the now-obsolete Encrypted SNI (ESNI) extension which allows the client to encrypt the hostname with a public key that is distributed via DNS. A newer alternative to ESNI is the Encrypted Client Hello (ECH) extension which encrypts the entire Client Hello message, including the hostname.
Of course all of this only makes sense if DNS lookups are also hidden from the ISP. This can be achieved by using DNS over TLS (DoT) or DNS over HTTPS (DoH).
How useful it is to hide specific information depends on the exact context. For example, if there's only a single website behind an IP address, you don't gain anything from hiding the hostname. Traffic analysis is also still possible. If you want to address this as well, consider using Tor.
Ports are just numbers. You can run any service on port 443 and run a TLS site on any port. There's nothing special about the number other than the fact that some of them have default services that everyone agrees on.
The ISP will have to know the port number in order to route the traffic to the destination, so that needs to be exposed to the ISP.
However, just like the other questions you mentioned in your original post, TLS hides the path part of the URL.
From a pure technical perspective an ISP can get the same information from your traffic no matter if you use the standard ports for HTTP and HTTPS or non-standard ports. Deep Packet Inspection (DPI) allows to detect use of HTTP on HTTPS no matter which ports are used.
This means limited visibility for HTTPS (only domain and meta data), full visibility for plain HTTP (full URL and content), full visibility for plain DNS. And of course the ISP can get all network and transport layer information, which include IP addresses and ports.
Note that just because an ISP might technically observe your traffic does not mean they actually do it. There are costs involved in doing this so they need a clear benefit to do it or regulations which require it.
answered Jun 13 at 19:41
-
-
@schroeder: did we have one for non-standard ports? That's what I reduced the OPs question to. Jun 13 at 19:41
-
-
I think the OP is looking more for the technical details of how the ports affect things. I.E. the ISP needs the port to route traffic.– schroeder ♦Jun 13 at 19:45
-