When you’re securely visiting a website via https:// the data sent between the server and your browser is encrypted but what about the URLs you’re visiting within the site? Can your ISP or other third party observer see what you’re looking at?
Today’s Question & Answer session comes to us courtesy of SuperUser—a subdivision of Stack Exchange, a community-driven grouping of Q&A web sites.
The Question
An anonymous SuperUser reader wants to know if their browsing sessions are completely secure:We all know that HTTPS encrypts the connection between the computer and the server so that it cannot be viewed by a third party. However, can the ISP or a third party see the exact link of the page the user accessed?An interesting question that certainly has implications for personal privacy. Let’s investigate.
For example, I visit:
https://www.website.com/data/abc.html
Will the ISP know that I accessed */data/abc.html or just know that I visited the IP of www.website.com?
If they know, then why does Wikipedia and Google have HTTPS when someone can just read the internet logs and find out the exact content the user viewed?
The Answer
SuperUser contributor Grawity offers a very concise overview of how the full URL is processed along the way:From left to right:In short, everything to the right of the domain name is encrypted by the HTTPS session and remains invisible to your ISP or anyone else peeking in your activities.
The schemahttps:
is, obviously, interpreted by the browser.
The domain namewww.website.com
is resolved to an IP address using DNS. Your ISP will see the DNS request for this domain, and the response.
The path/data/abc.html
is sent in the HTTP request. If you use HTTPS, it will be encrypted along with the rest of the HTTP request and response.
The query string?this=that
, if present in the URL, is sent in the HTTP request – together with the path. So it’s also encrypted.
The fragment#there
, if present, is not sent anywhere – it’s interpreted by the browser (sometimes by JavaScript on the returned page).
No comments:
Post a Comment