Hacker News Reader

Comment by bisRepetita | Hacker News Reader

If I browse on https only, if websites were to use CDNs IP addresses that are used by many different sites, what could Comcast track from me?

They could see my DNS requests, which I believe are in clear, even if I use Google's name servers.

They would know the sites I go to, but not the pages/bookmarks...

If name resolutions were encrypted, we would be good, or ?

View on HN

This is a good visualization of what is shown when using HTTPS: https://www.eff.org/pages/tor-and-https

Very few sites have everything on a CDN, and that's not really possible for a large class of websites. So they can get IP addresses for web servers, which with reverse DNS they can get the domain name. They can also analyze the number of incoming versus outgoing packets to make certain inferences, like being able to tell whether you're watching a video on Facebook or upload one. That last one isn't that useful for advertising or anything, though, and requires TCP sessionization, which is tricky to scale, so I doubt they would do that.

Well currently name resolutions are not encrypted and I don't think it is technically possible to encrypt them, so we definitely aren't good. Asking everyone to route through a CDN is a bit impractical as well.

a good follow up article if you're interested: https://www.teamupturn.com/reports/2016/what-isps-can-see

Even a tiny bit of data(think DNS name resolution) collected over a long period of time can be pretty invasive to a persons privacy.

> If name resolutions were encrypted, we would be good, or ?

No, HTTPS Server Name Identification[1] means that domain names are still sent in the clear so that multiple HTTPS sites can have one IP address.

They can also see how much data goes is transmitted to which site, when, and for how long, which lets them infer all sorts of other information about your activity

Reply on news.ycombinator.com