4 ms·
But isn't this over HTTPS? I know the DNS lookup may leak the domain, but that's heavily cached. I think its just network analysis or possibly even those cachi
by 3pt14159 5y ago
But isn't this over HTTPS? I know the DNS lookup may leak the domain, but that's heavily cached.
I think its just network analysis or possibly even those caching servers that are run by ISPs which hold onto content network's most heavily used files.
- desdiv 5y agoI see two possible ways: 1. during the TLS handshake, the domain name itself might be sent in the clear if the SNI extension is used, and if the SNI extension isn't encrypted[1] 2. if the carrier knows the IP, then they can do a reverse DNS lookup to find the domain name [1] https://stackoverflow.com/questions/499591/are-https-urls-encrypted?rq=1 https://stackoverflow.com/questions/499591/are-https-urls-en...
- brewmarche 5y agoSNI leaks the host name over HTTPS. Also, if the IP addresses are distinct enough they could be used to detect the destination as well.
- dtech 5y agoNote that isn't the case any more with modern browser + server, TLS 1.3 Encrypted Client Hello (ECH) fixes this.
- caskstrength 5y agoLast time I checked TLS Encrypted Client Hello standard was still under heavy development and implementation in Firefox was disabled by default. Is this not the case anymore?
- silon42 5y agoIMO, it's a bad design... SNI encryption should be done by firewall, not the client.
- dtech 5y agoMy mistake, it seems to still be a draft standard
- brewmarche 5y agoBoth this draft and eSNI unfortunately are not widely in use.
- spapas82 5y agoBut the provider knows where you are connecting, no matter if https is used or not. Https will encrypt the payload/data (layer 7) not where you are connecting (layers 3/4)
- sumtechguy 5y agoThe packet header would leak that info too with src/dst IP addresses.
- nitwit005 5y agoThey likely have a peering setup with each of these companies, so they know the IP address ranges they're using for this video traffic. They can tag the traffic and shape it (drop packets in excess of some rate).