Linked Questions

74
votes
3answers
10k views

Are URLs viewed during HTTPS transactions to one or more websites from a single IP distinguishable?

For example, say the following are HTTPS URLs to two websites by one IP over 5 mins: "A.com/1", "A.com/2", "A.com/3", "B.com/1", "B.com/2". Would monitoring of packets reveal: nothing, reveal only ...
34
votes
3answers
9k views

Is HTTPS URL in plain text at first connection? [duplicate]

Let’s say I have never connected to the site example.com. If this site is https and I write https://example.com/supersecretpage will the URL be sent in clear text since it's the first time I connect ...
14
votes
1answer
2k views

What parties have access to the *full* requested URL of a website accessed via the HTTPS protocol? [duplicate]

What parties have access to the full requested URL of a website accessed via the HTTPS protocol? Here are some possibilities I can think of, and there could be more: local device accessing the ...
2
votes
2answers
3k views

privacy - Which parts of URL is protected by HTTPS? [duplicate]

Assuming the website I visit uses HTTPS, which parts of the URL is protected from the eyes of my ISP? eg; https://subdomain.domain.com/path/file.php?param=value I know that domain.com (and probably ...
4
votes
2answers
583 views

When using HTTPS, which part of domain is revealed to ISP? [duplicate]

Let's say you are visiting https://57vdyr6tyuibgyoihp.blogspot.com. Does the ISP only see the blogspot.com part, or the entire 57vdyr6tyuibgyoihp.blogspot.com?
2
votes
1answer
1k views

Is a long, random string in a URL considered adequate protection from unauthorised access? [duplicate]

I have recently had to submit a number of confidential PDF documents to a website. These documents contain more than enough information to use in identity theft, and I can conceive how others using ...
-1
votes
2answers
626 views

Does HTTPS encrypt visited URL? [duplicate]

Perhaps I am misunderstanding the way in which HTTP over SSL works, but I was interested in whether the addresses visited by a browser via HTTPS are themselves encrypted? This is not only in terms of ...
1
vote
2answers
570 views

Why does not Google switch to POST method for queries? [duplicate]

With ISPs getting license to record and sell customer's traffic data, why doesn't Google switch to POST method for search queries to provide better security to the users, while HTTPS is already used?
0
votes
0answers
94 views

Is it safe to use HTTPS websites over an unknown PPTP VPN? [duplicate]

I want to create e.g a Gmail account while connected to an unknown PPTP VPN. Is it safe, or can the owner of the PPTP VPN see my Gmail web page information, such as username or password, at all? Can ...
0
votes
1answer
40 views

HTTP/HTTPS/GET/POST : in which cases can a malicious router between client and server find a secret information? [duplicate]

Let's say I connect a safe server example.com. In which case(s) can a malicious router in the middle of the route (or my ISP) see secret? 1) HTTP + GET, secret in URL query parameter : http://...
0
votes
0answers
18 views

Will Internet provider know what sub-page I visited on a site? [duplicate]

Let's say in my address bar I see such link: Privatebin URL/key interception? Can somebody besides server and me know that I'm visiting not just security.stackexchangec.com but excactly ../questions/...
0
votes
0answers
14 views

Is password less login secure? [duplicate]

Recently I came across this password less login. For authentication, we need to enter an email address and click on a login button. We will receive a link in your email and when we click on that link ...
86
votes
9answers
99k views

Can my company see what HTTPS sites I went to?

At work my company uses internet monitoring software (Websense). I know if I visit a https ssl-encrypted site (such as https://secure.example.com) they can't see what I'm doing on the site since all ...
11
votes
4answers
24k views

Is it possible to sniff HTTPS URLs? [duplicate]

From many posts, I know that almost everything in HTTPS or SSL connections is encrypted. Still, I am wondering, if it is possible to get the URLs out of such a connection if the computer that opens ...
11
votes
3answers
23k views

Does a VPN hide what URLs I visit?

It's clear that someone listening on a network could still find out what website I visit over HTTPS (as discussed here) but what about when surfing in a VPN? What exactly can the underlying network (...
4
votes
3answers
2k views

sslstrip vs. privoxy redirect rule on clients

I watched this video: http://www.securitytube.net/video/193 Now I'm thinking about an example. Suppose I have a privoxy proxy on my PC: user.action file (just part of it): { +redirect{s@http://@...
6
votes
3answers
2k views

Cipher used for request data encryption used by browser

Please note that this is not about how SSL communication happens between browser (I researched and understood it) and client but other aspects. Using Digicert's SSL mechanism explanation I have ...
4
votes
2answers
280 views

Are the GET values also encrypted/secured by SSL?

For example we submit a form on the following site: https://example.com (SSL Encrypted) Then the form is submitted as GET method, so it becomes like this: https://example.com/form_action.php?user=...
3
votes
1answer
2k views

Dangers of passing Oauth 2.0 client id and client secret in the request uri

I was reading here that when passing a client_id and client_secret to an authorization server, The parameters can only be transmitted in the request-body and MUST NOT be included in the ...
-1
votes
1answer
1k views

Can SNI faking be useful for confusing Deep Packet Inspection (web filters etc.)?

There are several countries in our progressive world that apply filtering rules defined by the state — implementing censorship. As I can suppose, ISPs are blocking websites by their IPs. Just because ...
5
votes
1answer
486 views

Can wildcard certificates hide/obscure the hostname in a TLS connection?

I'm trying to increase security for my cloud-based / multi-tenant environment. I'm considering having clients access an obscure URL such as GUID.myCloud.com. I will then respond to that guid-based ...