5 ms·

If the location is passed as part of the url get request, wouldn't it still be visible if the request was through HTTPS? I mean it's in the url, isn't that alwa

by snorrah 12y ago

If the location is passed as part of the url get request, wouldn't it still be visible if the request was through HTTPS? I mean it's in the url, isn't that always going to be public, just not the resulting data returned?

jgrahamc 12y ago
No. That's not how HTTPS works.
- snorrah 12y ago
  Could you elaborate - I genuinely don't know the process involved. When an HTTPS request is processed, does the client first directly contact the host and negotiate the secure session, THEN pass the URI request along?
  - deleted 12y ago
    [deleted]
  - billpg 12y ago
    That's correct. The conversation, as seen by an eavesdropper will be: - Client makes DNS request to example.com. - DNS server (we hope the legitimate one) sends IP addr in response. - Client connects to server IP. - TLS negotiation including certs. - Bunch of bytes that look like noise. - Disconnect.
    - Tepix 12y ago
      In the case of SNI ( https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication ) the attacker will see which virtual host you contacted (it's probably the same as the one seen in the DNS lookup).
  - azdle 12y ago
    Exactly. TLS is, as the name implies, at the transport layer (TCP). (TLS is the same thing as SSL, the "S" in HTTPS, unless someone wants to be pedantic.) Everything that is at the HTTP level gets encrypted. The only exception to this is (sometimes) the hostname through a process call SNI (Server Name Indication), which sends the hostname as part of the TLS setup before an encrypted session is setup so that the server knows which website's certificate it should be using. This is the only way that you can host more than one website on a single IP address (unless they all share the same wildcard certificate or a single cert has an alt-name for each).
    - deleted 12y ago
      [deleted]
  - balabaster 12y ago
    The answers you have already to this are good enough to give you an idea of what's going on. If you want to dig further and actually have a look at what's going on when an http vs. https session is established, grab a tool like Fiddler or Wireshark (or Charles(?) on the Mac) to actually have a look at the traffic as it's transmitted and received. I'd suggest starting off easy with Fiddler or Charles as you won't have to trawl through a bunch of raw TCP traffic to figure it out, they're nicely filtered to HTTP/S traffic. Once you've figured out Fiddler, then dig further with Wireshark. Both tools are invaluable for debugging web traffic. There's a couple of tutorials that allow you to act as a man-in-the-middle on your own connection to sniff the SSL traffic and figure out what's going on: http://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/Fire.. http://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/Fire.... These tools are really useful in helping you understand further exactly what's going on.
blfr 12y ago
Only the hostname could be visible, not the entire URL.

by snorrah 12y ago

jgrahamc 12y ago

No. That's not how HTTPS works.

snorrah 12y ago
Could you elaborate - I genuinely don't know the process involved. When an HTTPS request is processed, does the client first directly contact the host and negotiate the secure session, THEN pass the URI request along?
- deleted 12y ago
  [deleted]
- billpg 12y ago
  That's correct. The conversation, as seen by an eavesdropper will be: - Client makes DNS request to example.com. - DNS server (we hope the legitimate one) sends IP addr in response. - Client connects to server IP. - TLS negotiation including certs. - Bunch of bytes that look like noise. - Disconnect.
  - Tepix 12y ago
    In the case of SNI ( https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication ) the attacker will see which virtual host you contacted (it's probably the same as the one seen in the DNS lookup).
- azdle 12y ago
  Exactly. TLS is, as the name implies, at the transport layer (TCP). (TLS is the same thing as SSL, the "S" in HTTPS, unless someone wants to be pedantic.) Everything that is at the HTTP level gets encrypted. The only exception to this is (sometimes) the hostname through a process call SNI (Server Name Indication), which sends the hostname as part of the TLS setup before an encrypted session is setup so that the server knows which website's certificate it should be using. This is the only way that you can host more than one website on a single IP address (unless they all share the same wildcard certificate or a single cert has an alt-name for each).
  - deleted 12y ago
    [deleted]
- balabaster 12y ago
  The answers you have already to this are good enough to give you an idea of what's going on. If you want to dig further and actually have a look at what's going on when an http vs. https session is established, grab a tool like Fiddler or Wireshark (or Charles(?) on the Mac) to actually have a look at the traffic as it's transmitted and received. I'd suggest starting off easy with Fiddler or Charles as you won't have to trawl through a bunch of raw TCP traffic to figure it out, they're nicely filtered to HTTP/S traffic. Once you've figured out Fiddler, then dig further with Wireshark. Both tools are invaluable for debugging web traffic. There's a couple of tutorials that allow you to act as a man-in-the-middle on your own connection to sniff the SSL traffic and figure out what's going on: http://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/Fire.. http://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/Fire.... These tools are really useful in helping you understand further exactly what's going on.

blfr 12y ago

Only the hostname could be visible, not the entire URL.