It may be encrypted -- but is it protected against traffic analysis? The following papers are a good starting point: [1] Guessing the URLs being browsed by us

It may be encrypted -- but is it protected against traffic analysis? The following papers are a good starting point: [1] Guessing the URLs being browsed by users over an encrypted TLS session: https://research.microsoft.com/en-us/um/people/gdane/papers/TLSanon.pdf https://research.microsoft.com/en-us/um/people/gdane/papers/... [2] Guessing the co-ordinates of where a user is scrolling around on Google Maps over an encrypted TLS session: http://www.ioactive.com/pdfs/SSLTrafficAnalysisOnGoogleMaps.pdf http://www.ioactive.com/pdfs/SSLTrafficAnalysisOnGoogleMaps.... [3] Guessing the content of encrypted VoIP conversations: http://www.cs.unc.edu/~amw/resources/hooktonfoniks.pdf http://www.cs.unc.edu/~amw/resources/hooktonfoniks.pdf [4] Guessing communication paths on the Tor network with only a partial view of the network (not strictly related to encryption but the principles of traffic analysis are relevant): http://www.cl.cam.ac.uk/users/sjm217/papers/oakland05torta.pdf http://www.cl.cam.ac.uk/users/sjm217/papers/oakland05torta.p... [5] Guessing passwords sent over the SSH protocol using keystroke timing analysis: http://users.ece.cmu.edu/~dawnsong/papers/ssh-timing.pdf http://users.ece.cmu.edu/~dawnsong/papers/ssh-timing.pdf