4 ms·

If I browse on https only, if websites were to use CDNs IP addresses that are used by many different sites, what could Comcast track from me? They could see my

If I browse on https only, if websites were to use CDNs IP addresses that are used by many different sites, what could Comcast track from me? They could see my DNS requests, which I believe are in clear, even if I use Google's name servers. They would know the sites I go to, but not the pages/bookmarks... If name resolutions were encrypted, we would be good, or ?

RamshackleJ 10y ago
Well currently name resolutions are not encrypted and I don't think it is technically possible to encrypt them, so we definitely aren't good. Asking everyone to route through a CDN is a bit impractical as well. a good follow up article if you're interested: https://www.teamupturn.com/reports/2016/what-isps-can-see https://www.teamupturn.com/reports/2016/what-isps-can-see Even a tiny bit of data(think DNS name resolution) collected over a long period of time can be pretty invasive to a persons privacy.
af16090 10y ago
This is a good visualization of what is shown when using HTTPS: https://www.eff.org/pages/tor-and-https https://www.eff.org/pages/tor-and-https
openasocket 10y ago
Very few sites have everything on a CDN, and that's not really possible for a large class of websites. So they can get IP addresses for web servers, which with reverse DNS they can get the domain name. They can also analyze the number of incoming versus outgoing packets to make certain inferences, like being able to tell whether you're watching a video on Facebook or upload one. That last one isn't that useful for advertising or anything, though, and requires TCP sessionization, which is tricky to scale, so I doubt they would do that.
daxelrod 10y ago
> If name resolutions were encrypted, we would be good, or ? No, HTTPS Server Name Identification[1] means that domain names are still sent in the clear so that multiple HTTPS sites can have one IP address. They can also see how much data goes is transmitted to which site, when, and for how long, which lets them infer all sorts of other information about your activity

RamshackleJ 10y ago

Well currently name resolutions are not encrypted and I don't think it is technically possible to encrypt them, so we definitely aren't good. Asking everyone to route through a CDN is a bit impractical as well. a good follow up article if you're interested: https://www.teamupturn.com/reports/2016/what-isps-can-see https://www.teamupturn.com/reports/2016/what-isps-can-see Even a tiny bit of data(think DNS name resolution) collected over a long period of time can be pretty invasive to a persons privacy.

af16090 10y ago

This is a good visualization of what is shown when using HTTPS: https://www.eff.org/pages/tor-and-https https://www.eff.org/pages/tor-and-https

openasocket 10y ago

Very few sites have everything on a CDN, and that's not really possible for a large class of websites. So they can get IP addresses for web servers, which with reverse DNS they can get the domain name. They can also analyze the number of incoming versus outgoing packets to make certain inferences, like being able to tell whether you're watching a video on Facebook or upload one. That last one isn't that useful for advertising or anything, though, and requires TCP sessionization, which is tricky to scale, so I doubt they would do that.

daxelrod 10y ago

> If name resolutions were encrypted, we would be good, or ? No, HTTPS Server Name Identification[1] means that domain names are still sent in the clear so that multiple HTTPS sites can have one IP address. They can also see how much data goes is transmitted to which site, when, and for how long, which lets them infer all sorts of other information about your activity