ISP can detect DNS requests for a web site, ie www.google.com . If I have a website ie www.mysite.com, and a webpage ie www.mysite.com/mypage.html
and inside www.mysite.com/mypage.html , the web site www.google.com is embedded ( by using an IFRAME tag ). In this case, what ISP can detect ? DNS request for www.mysite.com/mypage.html ? OR DNS request for www.google.com OR both of the above ? Please note that with IFRAME there is no redirection, just the website inside a webpage ( please correct me if I am wrong - possibly I am ). My objective is ISP of my customers not detecting requests for www.google.com, instead they will only be able to detect requests to my business website. Possible ? This question is not duplicate with a previous post Can my customer's ISP trace who visited my business website?. Answers were: yes it is possible. The new question is if ISP can also detect visits to a website embedded in another website

  • It is related to security. I want to avoid possibility ISP employees providing information to my business competitors. Please see security.stackexchange.com/questions/46316/… – Guestseekinganswers Dec 31 '13 at 14:50
  • This feels a lot like your previous question - it looks like you are trying to do something that just can't work. ISPs will always have the possibility of looking at traffic that is unencrypted, and the URLs/IP addresses visited. If this is a problem to you then you need to revise your threat model. – Rory Alsop Dec 31 '13 at 15:12
  • If your problem is ISPs tracking who visits your site, why don't you try and make sure everyone visits your site? Add news feeds, blogs, whitepapers etc. Just a thought... – Rory Alsop Dec 31 '13 at 15:15
  • A web request is a web request, there isn't any discernable difference for the page being requested from an iframe or otherwise, as far as the DNS server is concerned. The referer string in the request header will point to the parent document's URL, but that's of no concern for the DNS server. If you want to bypass DNS translations of domain names to IP addresses, then don't use them. Use IP addresses directly. Your requests will still go via your ISP tho, so you might wanna rather use VPN (or Tor), so the target location can't be inferred. At least not as easily... – TildalWave Dec 31 '13 at 16:06
  • @Ropy Yes, correct, if I can't avoid tracking who visits my web site, why not doing the exact opposite. If everybody visits then pinpointing is not possible. But how do I substitute insecure emails as customers do not use encryption? Receiving orders and sending quotes through my web site is ideal. There is an international hype for sharelinks URL yet most have distinctive URL, example workspaces.acrobat. I can increase traffic to my web site but not to special URL such as workspaces.acrobat – Guestseekinganswers Dec 31 '13 at 16:09

If you use a domain name for an iframe in your site, the browser will have to resolve it. This means it will have to make a call to DNS from the client. There is no way for you to provide the resolution to them. If you can use an IP address for the site rather than a domain name, then the client could avoid the DNS look up, but the browser would still be going to the IP address to get the content of that frame and the ISP would still know about it.

It is worth pointing out, however, that they will not know that that DNS query was related to your site. There is no difference between them having a second tab open to Google while they are on your site and you actually putting it in an iframe. They might be able to figure it out by noticing the pattern, but it would be non-trivial to notice since the iframe is entirely pulled by the client.

The only way to prevent the ISP from knowing they are using Google at all though is to pull the information yourself and forward it on like a proxy, but that would look extremely suspicious to a client under most circumstances (in addition to being very technically challenging.) Even then, you'd have to make sure you are using an encrypted connection or they might be able to recognize the content you are sending as being Google depending on how paranoid you want to be about what ISPs are doing with that information.

Overall, the risk of customer's ISPs selling information to your competitors is basically non-existent though. It's too hard to figure out who would care about which connections and then trying to sell the information. The value of the information they would have is insignificant compared to the amount it would cost them to research who would care and to try to negotiate a deal for the information. Your threat model doesn't make sense because it would cost more to exploit than the potential benefit derived from exploiting it.

Also as some business advice, if your business is dependent on your competitors not knowing who your clients are, you are probably doing it wrong. Don't spend your time making it so your competitors can't figure out who your clients are, spend your time making your product better so that your customers wouldn't want to switch. That will do far FAR more for the security of your company.

| improve this answer | |
  • 3
    +1 for "Your threat model doesn't make sense" - that's the layer this problem should be considered on. – gowenfawr Dec 31 '13 at 15:12
  • @gowenfar & a@AJ Henderson. I agree with both and your clear and logical assumptions. Was like that few years ago. Unfortunately in a small country of incredible corruption, in an oligopoly, with business competitors earning 100-700 % net margins against your 20 % margin, with money and the means and the power and controlling authorities and IT technicians and life threatening situations then or you give up or fight back. In this case threat model changes. Please let's stick on the technical point as the forum requires. My objective is to ensure integrity of business communication. – Guestseekinganswers Dec 31 '13 at 15:39
  • @Guestseekinganswers - at that point, the question should be why do your competitors make so much more margin and why don't customers recognize that, or are you saying that they are pressuring your customers in to using their service instead through coercion. If that's the case, then there are more significant issues that you need to worry about and you really need to look at something like TOR to provide protection against that level of threat. Either your threat model is too suspicious or it is ineffectual for the need, either way, it needs to be re-evaluated. – AJ Henderson Dec 31 '13 at 16:30
  • @AJHenderson , answer is coercion and threat to be out of business. Can't elaborate. Not an IT expert, I am forced to secure my business communication. Can't use TOR, I use vpn, static ip with uk server not hiding from Western Europe from where my suppliers are. Customers don't use TOR or email encryption. Emails through servers in local ISP are insecure. Alternative: increase traffic to my site, ISP can't pinpoint users. Exchange of documents through my web site, using URL share link inside web page with IFRAME. Threat: distinctive URL names easily spotted by ISP. How to solve ? – Guestseekinganswers Dec 31 '13 at 17:13
  • 1
    @Guestseekinganswers - you are not embedding another service in your website, you are embedding a link to the other service. The browser loads content from other servers on the client side, not the server side. If you have an iframe with Google linked, then the client's browser will download that iframe (without the ISP knowing you have an iframe for Google), however then the browser will fill that iframe by contacting Google. You have no control over that connection as it is a third party connection between your customer and Google (or Acrobat Workspaces, etc) – AJ Henderson Dec 31 '13 at 18:22

If the iframe points to www.google.com, then yes, the client's browser will trigger a DNS lookup for www.google.com in order to load it.

If you want to embed a third party site in your own without the client browser knowing about it, the only way would be to have your web server proxy connections to that third party site. Which is difficult to do seamlessly, so people will probably figure it out anyway, and be creeped out that you're performing a MITM like that.

| improve this answer | |
  • 1
    apart from saying thanks to anybody who have answered my question, most above all HAPPY NEW YEAR for all of you and your families ! – Guestseekinganswers Dec 31 '13 at 17:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.