Using HTTPS? The URL may not be fully encrypted, hence can be tracked

Posted by sci_c0 on Monday September 16, 2019 @02:47AM
from the stackoverflow.com dept.

( 2 comments | 2 points | on HN )

Re:Using HTTPS? The URL may not be fully encrypted, hence ca... by sci_c0 on Monday September 16, 2019 @02:52AM (#20981654)

When request is made over HTTPS, the server name in the URL may not be encrypted, only the path to the resource will be encrypted.

i.e.

if you type https://www.example.com/path/to/my/resource?show=pretty then the www.example.com may be sent in plain text only the path part will be encrypted.

[ Parent | on HN ]

Re:Using HTTPS? The URL may not be fully encrypted, hence ca... by Piskvorrr on Monday September 16, 2019 @05:16AM (#20982295)

TL;DR: SNI sends hostname (not whole URL) in plaintext, ESNI (encrypted) is not widely supported (not in Chrome, off by default in Firefox, visited domain also needs to support it).

[ Parent | on HN ]