15
I think you're asking:
If the page at https://host1/ contains an <iframe> which loads https://host2/, does that mean the HTTPS connection to host1 somehow wraps the connection to host2?
No. While it may seem natural to think that if one page visually envelops another, there may be something similar happening with the underlying connections, this is ...
10
In most cases some man in the middle which is able to passively inspect the traffic can find out the hostname of all sites accessed. This is because this information is contained in the TLS handshake with this site, specifically the server_name extension (SNI - Server Name Indication) of the ClientHello.
It does not matter for this if the other site is ...
3
I answered this question over 10 years ago. Crikey. I have been linked to this question again recently, and I feel it is time to provide an updated answer. 10 years is not a long time, except in computing, where it is an eternity.
I have also learned a significant amount in the intervening time.
To address a comment left on this question: there's a ...
1
A host name is never private in any TLS context, period.
@mentallurg answer is correct, but it is less obvious than simply that the subframe is defined by the parent frame because it is ubiquitous that a third party script include is all the parent frame adds unknowingly that such a script will then fetch other resources and create child frames.
This is how ...
Only top voted, non community-wiki answers of a minimum length are eligible