5 ms·
> Recording browsing activity ("gee Mr. Smith, you sure do spend a lot of time looking up laws about X. Seems like a good thing to blackmail you about") Are th
by reustle 10y ago
> Recording browsing activity ("gee Mr. Smith, you sure do spend a lot of time looking up laws about X. Seems like a good thing to blackmail you about")
Are the URLs in an HTTPS request also encrypted? I was under the impression they weren't.
- theandrewbailey 10y agoThey are. The only thing that could be gathered from an HTTPS connection is the IP, and therefore, possibly the domain.
- billyhoffman 10y agoFor all browsers made in the last 10 years, SNI is sent as part of the SSL/TLS handshake, so the hostname of the site you are trying to connect to is included in the ClientHello and is visible to anyone that can monitor the network.
- mikecb 10y agoHostname, but not path.
- brians 10y agoThis is a common and dangerous mistake. The size and timing of requests is visible, as is the hostname. It is straightforward to watch a cafe and identify all the requests corresponding to Wikipedia, and within those the Tienenman Square page. HTTPS is designed to protect secrets, not privacy. That means short random bitstrings, given that the adversary knows you're passing short random bitstrings---TLS just keeps him from figuring out the actual random content.
- enraged_camel 10y agoThey are. Think about the fact that a lot of data exchange occurs via URL parameters (e.g. access tokens), so it would be a huge problem if they weren't also encrypted on HTTPS.