2

Even though HTTPS keeps HTTP paths private, is it not the case that the generally-unique payload sizes for particular URLs (on news articles, blogs, etc) provides a mechanism to reveal the URL anyhow to an observer? If so, how would a site remedy this?

Improve this question

1 Answer 1

Reset to default
2

Yes, if the site is public and its content is known to the attacker, the attacker with access to the encrypted traffic can find out which page on the blog the user visited just by measuring the size. The website could remedy this by padding all lengths of all pages to the maximum, and always including the same number of images, each with padded sizes. The images also need to be loaded by the browser on the same time for all pages.

Improve this answer
2
  • So it sounds like you're saying true URL privacy would be extremely difficult to achieve in practice? :D
    – dliggat
    Nov 20, 2014 at 21:31
  • The URL stays private, the attacker can only guess the page. The attacker doesn't know whether you go to this paragraph on the page or some other. But preventing the attacker from knowing you go to the wikipedia article about paris is hard, yes. Of course its harder for the attacker if a site has lots of similar pages.
    – user10008
    Nov 20, 2014 at 21:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .