If someone hides their DNS traffic by encrypting it with a service such as OpenDNS's DNSCrypt, would you still be able to see which URLs they're viewing?

Also, if that person uses HTTPS 100% of the time, can you tell which pages they access?

Or would sniffing their packets show which pages and sites they were accessing as usual?


Yes, if you're watching the traffic, you can still tell which address a person is connecting to whether or not you can see the contents of that traffic. That's the nature of IP packets. There's no way around it. Then it's just a matter of doing a reverse-lookup on the destination IP to see it's owned by Facebook or Twitter.

You can shift the problem elsewhere by using a VPN to connect to some "safe" location, perhaps at work, perhaps at a datacenter. If all your IP traffic is tunneled over that VPN, then someone watching the tunnel can't tell what sites you're visiting.

However, someone watching the traffic at the far end of the tunnel, perhaps at your datacenter or at your office, is again able to see the traffic and make usage judgements just as your ISP can now.

Tor works on the same principle as a VPN, except that with Tor, the VPN is to some unknown endpoint somewhere out on the Internet, following a series of unpredictable hops that's difficult to trace.

  • Thanks for your great answer. Would it be possible to see which pages the person is accessing (eg, /mypage.html) – Joseph Feb 7 '14 at 17:58
  • HTTPS hides that information – tylerl Feb 7 '14 at 18:03
  • Even further, in this age of virtual hosting you cannot even have any real assurance that you know which domain or site the person is talking to unless the server to which they are speaking only serves a single domain! – David Hoelzer Feb 7 '14 at 22:35
  • 1
    You can determine hostname by inspecting the Ssl certificate during the handshake – Dog eat cat world Feb 8 '14 at 13:28

Just to add on HTTPS. It does not provide privacy of what you're requesting and getting answers from. It provides privacy for the content. So what is leaked is:

  • Canonical Name of the Certificate - i.e. domain for which the cert was issued for.
  • SNI (or Server Name Indication) - i.e. domain for which the request was made for.

SNI was introduced to allow multiple domains be hosted on the same IP:PORT.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.