Hacker News Reader

Comment by jimbob45 | Hacker News Reader

I'm a bit of an internet novice so excuse me if this is dumb but won't the ISP still know which IP I've connected to? Just because I haven't conveniently looked it up in their giant DNS dictionary doesn't mean they can't just follow the traffic, right?

View on HN

Yes, you're right that they will know to which server you have connected (HTTPS has nothing to do with it), but they might not know which site you have tried to access because some servers will host many sites.

Edit, to clarify: this depends on the protocol, as someone has noted further down, but in principle you could have an encrypted protocol in which case the ISP (or any other routing node) could only with which server you have exchanged packets.

It is possible to host multiple domains at the same IP address. In case a site uses e.g. Cloudfare, there can be a very large number of sites hosted at the same IP address. Hence, it is not always possible to figure out what website is being visited based on the IP address.

They will indeed know the IPs, and the SNI domain name information from HTTPS connections which don't encrypt that.

Note, on Firefox if you enable the DoH and the esni mechanisms in about:config. Then that information is encrypted to cloudflare hosted sites. At that point, they can't even use deep packet inspection to identify which sites were visited.

No HTTPs is encrypted.

Edit oops I thought OP said what they communicate not what IP.

But how does that tie in with SNI? The specs say that the client sends the intended hostname as part of the TLS handshake, can the ISP sniff the hostname from that handshake?

[edit] as per wikipedia, https://en.wikipedia.org/wiki/Server_Name_Indication:

The desired hostname is not encrypted, so an eavesdropper can see which site is being requested. This helps security companies provide a filtering feature and governments implement censorship. [..] As of mid 2018, an upgrade called Encrypted SNI (ESNI) is being rolled out in an "experimental phase" to address this risk of domain eavesdropping. On March 1, 2019, Daniel Stenberg stated that Mozilla Firefox supports ESNI.

Which is why encrypted SNI is in development

Test for eSNI here: https://www.cloudflare.com/ssl/encrypted-sni/

You can sniff SNI which will still reveal hostnames. In certain cases though, you can use 'domain fronting'. That is using a different Host in the HTTPS header than is included in SNI. If that other hostname is served by the same ip address and certificate, then that server might just forward your HTTPS message to the host requested in the HTTPS header.

Reply on news.ycombinator.com