5 ms·
> You can also use this technique with plain https to see if a user that visits a certain website is downloading certain files from it, or accessing certain pag
by getsat 16y ago
> You can also use this technique with plain https to see if a user that visits a certain website is downloading certain files from it, or accessing certain pages inside the website.
How do you do this when all the HTTP headers (the Server: and actual GET/POST) are part of the encrypted stream of data? You can't even see the specific domain they're trying to access, only the host/ip of the server.
Am I missing something?
- mike-cardwell 16y agoI explained this in a comment further up. I'll repeat here: It's just simple traffic analysis. A page load generates a certain number of request/responses. Each request and response is a specific size, and will be transferred in a specific order. You create a fingerprint of that and it doesn't matter if the page is opened via a plain http channel, or https, or over Tor, The fingerprint will be the same (almost).
- getsat 16y agoThanks for the explanation. I misunderstood the context of your comment.