We've established that, for all intents and purposes, HTTPS hides what page you visit on a given server from NSA backbone wiretapping, but not the domain itself. But that's only IP / domain correlation (across multiple domains), and nothing more.
As far as I understand, that's not fingerprinting.
I understand this increases my risk for (advanced, or not so advanced) fingerprinting, potentially hugely.
But if fingerprinting is only information that every server you accept connections from, sees, (such as what resources you accept from them or third-party servers, your cookie interaction, whether you GET their images and scripts, and so forth), then if all these details are encrypted inside the HTTPS session, does that mean the NSA can't actually fingerprint any HTTPS browsing you conduct on the Internet - assuming the certs for those domains are not compromised or cracked in any way?
Perhaps identifiable fingerprinting information can and does exist outside the encrypted information and in other parts of the whole picture here? (even if the attacks are very advanced - I'm thinking timing attacks?)
The only thing I just thought of, was: not allowing (or only allowing very specific, and limited) third-party resources, aka cross-site requests, on the various HTTPS domains your IP visits (via RequestPolicy). Could the NSA, in collecting and analyzing all your various HTTPS traffic metadata, by the fact of you simply not having any or many of the common third-party domain sites connected to (especially when not at the same time), when they know it would be normal to have that in the stream, fingerprint you uniquely just from that?
If the answer is yes to that, would the answer to this question then be, HTTPS significantly reduces the amount of ways in which the NSA can fingerprint you (but you can mess up in a whole lot of other ways)?