4 ms·

I'm a bit of an internet novice so excuse me if this is dumb but won't the ISP still know which IP I've connected to? Just because I haven't conveniently looked

I'm a bit of an internet novice so excuse me if this is dumb but won't the ISP still know which IP I've connected to? Just because I haven't conveniently looked it up in their giant DNS dictionary doesn't mean they can't just follow the traffic, right?

Ericson2314 7y ago
No HTTPs is encrypted. Edit oops I thought OP said what they communicate not what IP.
- tremon 7y ago
  But how does that tie in with SNI? The specs say that the client sends the intended hostname as part of the TLS handshake, can the ISP sniff the hostname from that handshake? [edit] as per wikipedia, https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication: The desired hostname is not encrypted, so an eavesdropper can see which site is being requested. This helps security companies provide a filtering feature and governments implement censorship. [..] As of mid 2018, an upgrade called Encrypted SNI (ESNI) is being rolled out in an "experimental phase" to address this risk of domain eavesdropping. On March 1, 2019, Daniel Stenberg stated that Mozilla Firefox supports ESNI.
  - arccy 7y ago
    Which is why encrypted SNI is in development
    - _o-O-o_ 7y ago
      Test for eSNI here: https://www.cloudflare.com/ssl/encrypted-sni/ https://www.cloudflare.com/ssl/encrypted-sni/
  - rocqua 7y ago
    You can sniff SNI which will still reveal hostnames. In certain cases though, you can use 'domain fronting'. That is using a different Host in the HTTPS header than is included in SNI. If that other hostname is served by the same ip address and certificate, then that server might just forward your HTTPS message to the host requested in the HTTPS header.
gtf21 7y ago
Yes, you're right that they will know to which server you have connected (HTTPS has nothing to do with it), but they might not know which site you have tried to access because some servers will host many sites. Edit, to clarify: this depends on the protocol, as someone has noted further down, but in principle you could have an encrypted protocol in which case the ISP (or any other routing node) could only with which server you have exchanged packets.
TazeTSchnitzel 7y ago
They will indeed know the IPs, and the SNI domain name information from HTTPS connections which don't encrypt that.
- kd913 7y ago
  Note, on Firefox if you enable the DoH and the esni mechanisms in about:config. Then that information is encrypted to cloudflare hosted sites. At that point, they can't even use deep packet inspection to identify which sites were visited.
rocqua 7y ago
It is possible to host multiple domains at the same IP address. In case a site uses e.g. Cloudfare, there can be a very large number of sites hosted at the same IP address. Hence, it is not always possible to figure out what website is being visited based on the IP address.

Ericson2314 7y ago

No HTTPs is encrypted. Edit oops I thought OP said what they communicate not what IP.

tremon 7y ago
But how does that tie in with SNI? The specs say that the client sends the intended hostname as part of the TLS handshake, can the ISP sniff the hostname from that handshake? [edit] as per wikipedia, https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication: The desired hostname is not encrypted, so an eavesdropper can see which site is being requested. This helps security companies provide a filtering feature and governments implement censorship. [..] As of mid 2018, an upgrade called Encrypted SNI (ESNI) is being rolled out in an "experimental phase" to address this risk of domain eavesdropping. On March 1, 2019, Daniel Stenberg stated that Mozilla Firefox supports ESNI.
- arccy 7y ago
  Which is why encrypted SNI is in development
  - _o-O-o_ 7y ago
    Test for eSNI here: https://www.cloudflare.com/ssl/encrypted-sni/ https://www.cloudflare.com/ssl/encrypted-sni/
- rocqua 7y ago
  You can sniff SNI which will still reveal hostnames. In certain cases though, you can use 'domain fronting'. That is using a different Host in the HTTPS header than is included in SNI. If that other hostname is served by the same ip address and certificate, then that server might just forward your HTTPS message to the host requested in the HTTPS header.

gtf21 7y ago

Yes, you're right that they will know to which server you have connected (HTTPS has nothing to do with it), but they might not know which site you have tried to access because some servers will host many sites. Edit, to clarify: this depends on the protocol, as someone has noted further down, but in principle you could have an encrypted protocol in which case the ISP (or any other routing node) could only with which server you have exchanged packets.

TazeTSchnitzel 7y ago

They will indeed know the IPs, and the SNI domain name information from HTTPS connections which don't encrypt that.

kd913 7y ago
Note, on Firefox if you enable the DoH and the esni mechanisms in about:config. Then that information is encrypted to cloudflare hosted sites. At that point, they can't even use deep packet inspection to identify which sites were visited.

rocqua 7y ago

It is possible to host multiple domains at the same IP address. In case a site uses e.g. Cloudfare, there can be a very large number of sites hosted at the same IP address. Hence, it is not always possible to figure out what website is being visited based on the IP address.