3 ms·
HTTPS/TLS doesn't try to anonymize which site a client is accessing; any intermediate can read the address of outgoing packets to determine the server's identit
by jmillikin 16y ago
HTTPS/TLS doesn't try to anonymize which site a client is accessing; any intermediate can read the address of outgoing packets to determine the server's identity. It's a little trickier when a server supports SNI, but few do.
TOR is supposed to prevent intermediaries from determining which sites a client is browsing, which is why this technique is interesting.
- mike-cardwell 16y agoYou can use this technique with Tor to make a reasonable guess if a user on your LAN is visiting a certain website. You can also use this technique with plain https to see if a user that visits a certain website is downloading certain files from it, or accessing certain pages inside the website. It is an interesting attack, but it's not one to get seriously worried about.
- getsat 16y ago> You can also use this technique with plain https to see if a user that visits a certain website is downloading certain files from it, or accessing certain pages inside the website. How do you do this when all the HTTP headers (the Server: and actual GET/POST) are part of the encrypted stream of data? You can't even see the specific domain they're trying to access, only the host/ip of the server. Am I missing something?
- mike-cardwell 16y agoI explained this in a comment further up. I'll repeat here: It's just simple traffic analysis. A page load generates a certain number of request/responses. Each request and response is a specific size, and will be transferred in a specific order. You create a fingerprint of that and it doesn't matter if the page is opened via a plain http channel, or https, or over Tor, The fingerprint will be the same (almost).
- getsat 16y agoThanks for the explanation. I misunderstood the context of your comment.