Does HTTPS protect you from fingerprinting by the NSA?

Question

We've established that, for all intents and purposes, HTTPS hides what page you visit on a given server from NSA backbone wiretapping, but not the domain itself. But that's only IP / domain correlation (across multiple domains), and nothing more.

As far as I understand, that's not fingerprinting.

I use the Tor Browser, with things like JavaScript and third-party cookies turned off, and add-ons like RequestPolicy and Self-Destructing Cookies installed, and in full use.

I understand this increases my risk for (advanced, or not so advanced) fingerprinting, potentially hugely.

But if fingerprinting is only information that every server you accept connections from, sees, (such as what resources you accept from them or third-party servers, your cookie interaction, whether you GET their images and scripts, and so forth), then if all these details are encrypted inside the HTTPS session, does that mean the NSA can't actually fingerprint any HTTPS browsing you conduct on the Internet - assuming the certs for those domains are not compromised or cracked in any way?

Perhaps identifiable fingerprinting information can and does exist outside the encrypted information and in other parts of the whole picture here? (even if the attacks are very advanced - I'm thinking timing attacks?)

The only thing I just thought of, was: not allowing (or only allowing very specific, and limited) third-party resources, aka cross-site requests, on the various HTTPS domains your IP visits (via RequestPolicy). Could the NSA, in collecting and analyzing all your various HTTPS traffic metadata, by the fact of you simply not having any or many of the common third-party domain sites connected to (especially when not at the same time), when they know it would be normal to have that in the stream, fingerprint you uniquely just from that?

If the answer is yes to that, would the answer to this question then be, HTTPS significantly reduces the amount of ways in which the NSA can fingerprint you (but you can mess up in a whole lot of other ways)?

Answer 1

You asked about https, not tor which is a different question, so I'll address the https part.

There's a lot of information sent in the clear to setup an https session. Probably the most obviously useful would be the client sending the cipher suites supported, cipher preferences, and SSL versions the client supports. Cipher suite support varies widely among the major browsers, and will even vary between versions of the same browser. For this reason it'd be trivial to identify broadly which browser the user is using (ie, Chrome, Firefox), and in many cases narrow it down to a range versions of the browser. Internet Explorer for example has only a few versions, so it's trivial to identify which version is being used.

IP addresses tend to stick around for a long time. Say you had 3 people using the same IP address, Alice, Bob, and Charlie. Alice uses Internet Explorer, Bob uses Firefox, and Charlie uses Chrome, it'd be relatively simple to distinguish which user is visiting a secure website if you'd identified the IP address.

In addition, the client sends date and time information as well. That could also be very useful in fingerprinting a client.

All in all, I'd say it's very possible that at least some fingerprinting can be accomplished over SSL with only passive listening.

Answer 2

Short answer is no. First of all it is widely assumed that they can read HTTPS content. Link: The NSA Can Beat Almost Any Type of Encryption

If you are interested in fingerprinting, go to http://panopticlick.eff.org - and you will see that your combination of extensions, plug-ins, fonts, etc., all are part of your browser fingerprint.

That information shows up in server logs as you visit, even if using a VPN. That doesn't give your IP address (and location), unless you also visit the same servers without using the VPN even just one time. Once you do that, they can correlate the fingerprint with your location.

On Tor, be sure you use TAILS, which is the same for everyone.

By the way, the NSA and FBI are not your primary threat. The people to worry about are server operators, and others who might try to sniff WiFi while you are using it.

The two most risky kinds of servers to avoid are gambling and porn. Those sites are where you are most likely to catch a cold - i.e. to have a drive-by installation of malware.

It is always a good idea to run regular scans by using MalwareBytes to be sure you are not picking up germs as you travel around the net.

HTTPS is great in that it prevents sniffers from getting into your business as you work from Starbucks or at an airport. It is a good idea to use the HTTPS-Everywhere extension in Chrome to make sure it gets used even if you forget to type https:// in URLs.

If you are worried that your ISP knows which websites you are visiting, then don't use their DNS servers. Comodo Secure DNS works great, and to use it all you have to do is use 8.26.56.26 and 8.20.247.20 as your DNS servers. Or you can even use Google's DNS servers at 8.8.8.8 and 8.8.4.4

I highly recommend using one of these alternatives. I use Comodo, because they also flag malicious content.

If you really are worried about the NSA, read this article from Bruce Schneier about staying secure against them - Note his subheading of this article: "The NSA has huge capabilities – and if it wants in to your computer, it's in. With that in mind, here are five ways to stay safe."

My advice is to make sure you don't become a target of FBI, CIA, DHS, NSA, DIA, or any of the TLAs (three-letter agencies).

Because, as said in the OP, we are a drop in the sea, as we go about our daily lives. But never forget that the tallest trees are the first to be cut for lumber. Or the tallest nails get hammered first. Whichever metaphor you prefer. I like how Google said it first: Don't be evil.