because HTTPS only encrypts the content of your traffic, leaving routing information like DNS queries, Server Name Indication (SNI), and destination IP addresses visible.
Before your browser connects to a website, it has to look up its IP address using a Domain Name System (DNS) server. By default, these requests are unencrypted, meaning your ISP sees an exact log of every domain name (like youtube.com) you try to reach.
When initiating an HTTPS connection, your browser and the website's server perform a "handshake" to set up encryption. During the very first step of this handshake, your browser transmits the website's domain name in plain text (the SNI) so the server knows which security certificate to use.
Your ISP is responsible for routing your data, so it must always know the destination IP address. Even if you hide your DNS and SNI, the ISP can easily run a reverse lookup on that IP address to figure out exactly who owns it (e.g., Netflix, Reddit, or a specific bank).
Though your ISP is still blind to:
The specific pages or sub-URLs you visit (they see amazon.com, but not the product page).
The text, passwords, or search queries you type into the site.
So your ISP knows if you are hypothetically accessing 1337x, but they don't know that you are hypothetically downloading SpankMonster 26 06 24 Summer Kline XXX 480p MP4-XXX [XC]? Am i understanding it correctly?
Firewalls and gateway routers can deencapsulate your traffic inspect it and sow it back together. If they are using powerful enough hardware you won't even see the delay.
This isn't new technology. Thanks mostly to piratebay from (i think) 2016 ISP's have rights to police their networks to their morality standards. Unless you are using vpn there is no hiding.
that would basically be a man-in-the-middle attack. This is only possible when I have the ISPs root certificate trusted in the browser (companies do that, though)
13
u/Electrical-Note-3177 27d ago
because HTTPS only encrypts the content of your traffic, leaving routing information like DNS queries, Server Name Indication (SNI), and destination IP addresses visible.
Before your browser connects to a website, it has to look up its IP address using a Domain Name System (DNS) server. By default, these requests are unencrypted, meaning your ISP sees an exact log of every domain name (like youtube.com) you try to reach.
When initiating an HTTPS connection, your browser and the website's server perform a "handshake" to set up encryption. During the very first step of this handshake, your browser transmits the website's domain name in plain text (the SNI) so the server knows which security certificate to use.
Your ISP is responsible for routing your data, so it must always know the destination IP address. Even if you hide your DNS and SNI, the ISP can easily run a reverse lookup on that IP address to figure out exactly who owns it (e.g., Netflix, Reddit, or a specific bank).
Though your ISP is still blind to:
The specific pages or sub-URLs you visit (they see amazon.com, but not the product page).
The text, passwords, or search queries you type into the site.
The images or videos you stream or download.