ISPs do not know as much as Google/FB thanks to SSL, but they know a lot more than you'd think by analyzing connection metadata.

Also many ISPs are also carriers, which makes things worse.

Source: worked for telecos, have seen a lot of shady stuff myself.

I guess there are feasible attacks if the ISP is sufficiently motivated. They can't read the data transmitted, but they know how many bytes is in it, and with a cross reference on page sizes in the domain you're on, they might be able to narrow it down considerably.(maybe even to 1 possible page)

A more far-fetched attack is a sort of timing attack: if you first visit arstechnica.com and then shortly afterwards visit Amazon.com, one could look for links to Amazon on arstechnica and from there have a decent guess what product you viewed on Amazon. This becomes a lot more feasible when paired with the first attack mentioned above.

These are all smart thoughts but you’ve clearly never worked for or with an ISP. As business entities in general they don’t have that kind of technical sophistication. They are more on the level of “we have to hire these vendor consultant groups to install VMs for us” than “we build a crawler so that we can use domain plus byte count to drink-anonymize visited pages.”

It doesn’t matter that most of them might not be that capable. They just hoard this data and sell it to the people with the means and resources.

It's not that easy to hoard when you have less than one competent engineer in the company and have to contract out to some vendor to build the data lake where they can hoard it.

Hoarding itself is beyond the sophistication of most service providers in the present day.

BT (a UK ISP) were up to hijinks in 2008 - "BT and Phorm: how an online privacy scandal unfolded"

https://www.telegraph.co.uk/technology/news/8438461/BT-and-P...

Yes. The problem for them is that times have changed.

ISPs have perfect knowledge of your IP, so if they can get even basic traffic logs from _anything else_ can reconstruct your browsing history more accurately than any other third-party. Since you are probably visiting your ISP's site regularly to pay your bill, there are also a lot of possibilities for them to regularly associate third-party cookies with your login. They also have the highest-quality ambient location data (outside of explicit app permissions) to link with all of that.

ISPs didn't even want to log IP data until 70+ year old people forced them to collect that info. Sorry for the rant against older gents, but this is the current reality.

Now they might think differently because there is a market for info. Thank you government...

Oh not to mention, this might soon change as eSNI/ECH is adopted! Then the only information being leaked would be the IP address of the server. And with widespread use of CDNs nowadays would make the information collected pretty useless. Ofcourse that is if your DNS queries are not leaking everything. (which they are! Use DNS-over-HTTPs guys!)

do we need randomized dom nodes ?

I guess I'd have to hear more details to know exactly what you're thinking, but my first instinct is to say that doing something like that would break CSS and accessibility without actually offering any significant impediment to tracking.

The cohort concerned about tracking, one would think, would not be deterred by broken CSS considering they already live in a JS-free world and might be used to some visual-compromise when browsing.

I was mostly wondering about privacy up to the dom layer (if that's even possible)

No.