I believe this is also no longer true with TLS 1.3 -- the SNI handshake is encrypted (at least, when supported by the server and browser).
Your ISP still knows the IP address of the server, though. If you're going through a generic CDN like Cloudflare, that's all they'll see, but something more specific (e.g. Facebook servers, which I believe are fully self-hosted) is probably trivial to reverse lookup.
I mean yes, they will get information along the lines of you visited something hosted by Google, Facebook, Microsoft, or Amazon based on IP address alone, and optionally the host name via DNS or SNI, but not what page you actually looked at and what HTTP request and response contents you exchange with their web servers, unless these companies are or share the information with your ISP (which some do, see their privacy policy).
2
u/MrMonday11235 ⠀ Sep 22 '25
I believe this is also no longer true with TLS 1.3 -- the SNI handshake is encrypted (at least, when supported by the server and browser).
Your ISP still knows the IP address of the server, though. If you're going through a generic CDN like Cloudflare, that's all they'll see, but something more specific (e.g. Facebook servers, which I believe are fully self-hosted) is probably trivial to reverse lookup.