Even though HTTPS keeps HTTP paths private, is it not the case that the generally-unique payload sizes for particular URLs (on news articles, blogs, etc) provides a mechanism to reveal the URL anyhow to an observer? If so, how would a site remedy this?

up vote 2 down vote accepted

Yes, if the site is public and its content is known to the attacker, the attacker with access to the encrypted traffic can find out which page on the blog the user visited just by measuring the size. The website could remedy this by padding all lengths of all pages to the maximum, and always including the same number of images, each with padded sizes. The images also need to be loaded by the browser on the same time for all pages.

  • So it sounds like you're saying true URL privacy would be extremely difficult to achieve in practice? :D – dliggat Nov 20 '14 at 21:31
  • The URL stays private, the attacker can only guess the page. The attacker doesn't know whether you go to this paragraph on the page or some other. But preventing the attacker from knowing you go to the wikipedia article about paris is hard, yes. Of course its harder for the attacker if a site has lots of similar pages. – user10008 Nov 20 '14 at 21:43
  • Makes sense; thanks. – dliggat Nov 20 '14 at 21:56

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.