4 ms·

Your isp (or any middle man) knows the IP address you’re connected to. On a public website they know everything you’re seeing anyway, if it’s encrypted or not.

zinekeller 6y ago
> Your isp (or any middle man) knows the IP address you’re connected to. The proliferation of CDNs made this mostly moot (big exception are huge companies or individuals who want to control everything using their own IP addresses) to the point governments tend to try to actively intercept requests due to the stubborn opaqueness.
- CyberRabbi 6y ago
  It’s not mostly moot. Most web sites do not use CDNs. And to the extent that websites do use CDNs, then your isp is no longer your concern for privacy, the CDN is.
  - captn3m0 6y ago
    There’s also SNI leaks (for now).
    - zinekeller 6y ago
      Valid point, kind of hard to solve actually because at some point the server needs to know who are you talking to. Limiting it is the current target for proposed standards, but alas it is an open problem for now.
  - zinekeller 6y ago
    > Most web sites do not use CDNs. And unless your typical user is actually a developer, you are out of the park. I forgot about SNI leakage. That's a valid point. There are CDNs you wouldn't have thought to be actually CDNs. Most Wordpress sites (outside of WordPress.com) are actually being run on WordPress.com infrastructure, and even if not they are often shared installations such as from Namecheap or GoDaddy, which shares the same addresses. Not to mention alternative building sites like Wix, Squarespace, Carrd, or even GitHub (surprise!). Or independent shopping sites, most are actually just Etsy (operates on etsy.com) or Shopify (you can use a domain if you want to). And that's scratching the surface of how changed web is now. You have underestimated how centralised is the web now. This can be bad or good (despite comments from second-hand critics, the French Minitel was amazing for its time, and on the flipside Facebook).
    - CyberRabbi 6y ago
      To the extent that the web is centralized my second point holds: TLS does nothing to protect you from the platform owners and you’re not much worse off going plaintext.
- pabs3 6y ago
  I suggest reading this presentation and blog post: "What can you learn from an IP?" https://irtf.org/anrw/2019/slides-anrw19-final44.pdf https://irtf.org/anrw/2019/slides-anrw19-final44.pdf https://blog.apnic.net/2019/08/23/what-can-you-learn-from-an-ip-address/ https://blog.apnic.net/2019/08/23/what-can-you-learn-from-an...

zinekeller 6y ago

> Your isp (or any middle man) knows the IP address you’re connected to. The proliferation of CDNs made this mostly moot (big exception are huge companies or individuals who want to control everything using their own IP addresses) to the point governments tend to try to actively intercept requests due to the stubborn opaqueness.

CyberRabbi 6y ago
It’s not mostly moot. Most web sites do not use CDNs. And to the extent that websites do use CDNs, then your isp is no longer your concern for privacy, the CDN is.
- captn3m0 6y ago
  There’s also SNI leaks (for now).
  - zinekeller 6y ago
    Valid point, kind of hard to solve actually because at some point the server needs to know who are you talking to. Limiting it is the current target for proposed standards, but alas it is an open problem for now.
- zinekeller 6y ago
  > Most web sites do not use CDNs. And unless your typical user is actually a developer, you are out of the park. I forgot about SNI leakage. That's a valid point. There are CDNs you wouldn't have thought to be actually CDNs. Most Wordpress sites (outside of WordPress.com) are actually being run on WordPress.com infrastructure, and even if not they are often shared installations such as from Namecheap or GoDaddy, which shares the same addresses. Not to mention alternative building sites like Wix, Squarespace, Carrd, or even GitHub (surprise!). Or independent shopping sites, most are actually just Etsy (operates on etsy.com) or Shopify (you can use a domain if you want to). And that's scratching the surface of how changed web is now. You have underestimated how centralised is the web now. This can be bad or good (despite comments from second-hand critics, the French Minitel was amazing for its time, and on the flipside Facebook).
  - CyberRabbi 6y ago
    To the extent that the web is centralized my second point holds: TLS does nothing to protect you from the platform owners and you’re not much worse off going plaintext.
pabs3 6y ago
I suggest reading this presentation and blog post: "What can you learn from an IP?" https://irtf.org/anrw/2019/slides-anrw19-final44.pdf https://irtf.org/anrw/2019/slides-anrw19-final44.pdf https://blog.apnic.net/2019/08/23/what-can-you-learn-from-an-ip-address/ https://blog.apnic.net/2019/08/23/what-can-you-learn-from-an...