13

Say, I use a public WiFi connection to load https://google.com in the browser, and then continue browsing on that site for a few more pages (performing searches in Google).

Can anyone else (like someone using the same WiFi connection or even an ISP) view that I have visited Google? I don’t mean which Google searches I’ve performed, but the mere fact that I’ve visited Google.

If not, how is my browser able to establish an HTTPS connection with Google Search without anyone being able to register that.

marked as duplicate by SilverlightFox, Stephane, Xander, schroeder, Gilles Jul 9 '15 at 17:31

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • I assume that using Tor or some other kind of encrypted proxy connection -- even using e.g. a company VPN, probably -- would hide your actual connections. None of them is, however, perfectly secure. Not good enough for the NSA, but good enough for your wife and/or boss. – Peter A. Schneider Jul 9 '15 at 8:30
  • Whom are you trying to thwart? The kid next table in Starbucks? Or your ISP, or a governmental agency? If it's the kid, just set up a OpenVPN server behind your router at home (with port forwarding) and have it push the router as primary DNS. That way, all DNS queries are made from another location. Now just pray that the kid can't be bothered to run a reverse lookup of all hosts you connect to, in that case, you'd need something more elaborate (run all traffic through VPN, or Tor). What's the point, though... nothing useful the kid can do with the information. – Damon Jul 9 '15 at 10:55
23

The hostname is transmitted in the clear. This is because HTTPS is a tunnel established after a connection to the server. The hostname is available for an eavesdropper to snoop in a number of ways:

  • You will perform a DNS lookup and that is always in the clear;
  • There is a TCP connection to the IP address returned by the DNS for google.com;
  • In the case of SNI, the HTTPS request will include the hostname;
  • As part of the TLS handshake, the server will supply the certificate in plaintext which contains the hostname.

The rest of the url, which includes any parameters, is not transmitted in the clear, so it is not subject to eavesdropping. All headers, including the cookies, are also transmitted encrypted. The attacker can however see the size of any communications and potentially draw conclusions from that.

  • I’m assuming there is no way to prevent the hostname from being transmitted in the clear. If not, this would mean that even with HTTPS, the information about which sites I visit is still not private. – Šime Vidas Jul 9 '15 at 3:01
  • @ŠimeVidas That is correct. Even if the protocol was redesigned and DNS was encrypted it would still be trivial to determine what site your accessing. Ultimately you would need to connect to some IP address. An eavesdropper could just do a reverse DNS or simply browse to that IP address to determine the hostname. If you wish to obfuscate the hostname you would need to use something like Tor or I2P. – Gerald Davis Jul 9 '15 at 3:06
  • 4
    @ŠimeVidas for what it's worth SSL isn't designed to be able to do what you are wanting because SSL is designed to work over a direct connection from client to the destination server without relying on a third party. You'd need to tunnel all your IP communications via a third party to hide which server you are connecting to (Tor is one example, but any VPN works on this principle). Then a network attacker won't see the end server, only the address of the tunnel entry point. – thomasrutter Jul 9 '15 at 7:09
  • The DNS lookup need not happen immediately in context with the URL request. In fact you might have added some favorite entries to your hosts file. – Hagen von Eitzen Jul 9 '15 at 10:07
  • @HagenvonEitzen True but as pointed out the issue is that ip addresses are not a secret. Even if all hostname references were encrypted you are still connecting to a specific ip address. So an evesdropper sees you establish a connection to 74.125.239.48 it is trivial to a reverse DNS and determine that is www.google.com. The only way to avoid that (or at least make it more difficult) would be to not connect directly to the server and use an intermediary (VPN, Tor, I2P, etc). – Gerald Davis Jul 9 '15 at 12:19

Not the answer you're looking for? Browse other questions tagged or ask your own question.