How private is HTTPs to an ISP?

For example, Can my ISP know the entire URL (Not only the domain) while connecting to a website with HTTPs? Can my ISP see images loaded through a website connected to HTTPs? Would my ISP know the subdomain I'm visiting through HTTPS?

1

2 Answers

Can my ISP know the entire URL (Not only the domain) while connecting to a website with HTTPs?

  • They will know/be able to log what IP you are accessing by virtue of TCP/IP packets traversing through the ISP. The contents of the URL are encrypted, query strings and anything after the cannot be seen.
  • If you used your ISP's DNS servers to resovle the domain name in question, they are able to view/log this directly.
  • If you used an third-party non-ISP DNS provider to resolve the domain name, they are able to view/log this in transit as standard DNS is not encrypted. Some ISPs implement transparent proxying on standard DNS ports to prevent you from using a third-party DNS.

Can my ISP see images loaded through a website connected to HTTPs?

No. However, if the images are hosted on a separate domain, they can see the domain being accessed and the above applies.

Would my ISP know the subdomain I'm visiting through HTTPS?

It's trivial to reverse-resolve an IP into the full domain name.

2

  1. There are many types of VPNs available, and even SSL varies in strength, so there is no clear way to do an apples-to-apples comparison. Some advertised VPNs are just an SSL tunnel anyway, but others are not. I don't believe SSL is a particularly strong tool against an ISP or nation-state level actor.

  2. The URL is a Layer 7 construct, so it would be hidden from the ISP when using HTTPS (a layer 4 protocol), presuming they haven’t compromised the secured tunnel, which they are capable of doing.

  3. A layer 2 or 3 VPN (IPSEC/L2TP) will send the entire DNS datagram through the tunnel, so presumably the ISP would not see it, as long as you are not using the ISP DNS servers.

10