News for hackers. Stuff that matters.
Re:UK ISP group names Mozilla 'Internet Villain' for support... by jimbob45 on Friday July 05, 2019 @10:33AM (#20362789)
I'm a bit of an internet novice so excuse me if this is dumb but won't the ISP still know which IP I've connected to? Just because I haven't conveniently looked it up in their giant DNS dictionary doesn't mean they can't just follow the traffic, right?
Re:UK ISP group names Mozilla 'Internet Villain' for support... by gtf21 on Friday July 05, 2019 @10:40AM (#20362841)
Yes, you're right that they will know to which server you have connected (HTTPS has nothing to do with it), but they might not know which site you have tried to access because some servers will host many sites.

Edit, to clarify: this depends on the protocol, as someone has noted further down, but in principle you could have an encrypted protocol in which case the ISP (or any other routing node) could only with which server you have exchanged packets.

Re:UK ISP group names Mozilla 'Internet Villain' for support... by rocqua on Friday July 05, 2019 @11:23AM (#20363205)
It is possible to host multiple domains at the same IP address. In case a site uses e.g. Cloudfare, there can be a very large number of sites hosted at the same IP address. Hence, it is not always possible to figure out what website is being visited based on the IP address.
Re:UK ISP group names Mozilla 'Internet Villain' for support... by TazeTSchnitzel on Friday July 05, 2019 @10:40AM (#20362845)
They will indeed know the IPs, and the SNI domain name information from HTTPS connections which don't encrypt that.
Re:UK ISP group names Mozilla 'Internet Villain' for support... by kd913 on Friday July 05, 2019 @11:20AM (#20363171)
Note, on Firefox if you enable the DoH and the esni mechanisms in about:config. Then that information is encrypted to cloudflare hosted sites. At that point, they can't even use deep packet inspection to identify which sites were visited.
Re:UK ISP group names Mozilla 'Internet Villain' for support... by Ericson2314 on Friday July 05, 2019 @10:37AM (#20362822)
No HTTPs is encrypted.

Edit oops I thought OP said what they communicate not what IP.

Re:UK ISP group names Mozilla 'Internet Villain' for support... by tremon on Friday July 05, 2019 @10:40AM (#20362840)
But how does that tie in with SNI? The specs say that the client sends the intended hostname as part of the TLS handshake, can the ISP sniff the hostname from that handshake?

[edit] as per wikipedia, https://en.wikipedia.org/wiki/Server_Name_Indication:

The desired hostname is not encrypted, so an eavesdropper can see which site is being requested. This helps security companies provide a filtering feature and governments implement censorship. [..] As of mid 2018, an upgrade called Encrypted SNI (ESNI) is being rolled out in an "experimental phase" to address this risk of domain eavesdropping. On March 1, 2019, Daniel Stenberg stated that Mozilla Firefox supports ESNI.

Re:UK ISP group names Mozilla 'Internet Villain' for support... by arccy on Friday July 05, 2019 @10:41AM (#20362850)
Which is why encrypted SNI is in development
Re:UK ISP group names Mozilla 'Internet Villain' for support... by _o-O-o_ on Friday July 05, 2019 @11:09AM (#20363074)
Re:UK ISP group names Mozilla 'Internet Villain' for support... by rocqua on Friday July 05, 2019 @11:26AM (#20363246)
You can sniff SNI which will still reveal hostnames. In certain cases though, you can use 'domain fronting'. That is using a different Host in the HTTPS header than is included in SNI. If that other hostname is served by the same ip address and certificate, then that server might just forward your HTTPS message to the host requested in the HTTPS header.