Perhaps this has been discussed already at length in some other, earlier thread, but I do not recall seeing this before, so here it goes:
As it happens, it is possible for black hats, using the appropriate tools of their trade, to snoop on the usually secure https communications (being encrypted by default and only enabled with sites that have certificates issued from a valid source and also current) between user and sensitive places such a bank account, to gather information on what the user does at such sites, even if the contents of the communications remain inaccessible thanks to the encryption. (A very similar kind of snooping, I remember, was discussed last year in relation to something else: VPN of the type User->ISP -> VPN server -> Web server of destination, now with a false sender address.)
The snooper could gather such information as the IP address and port number of the web servers accessed by the user, and sometimes even the Web site domain name the user is communicating with, along with the amount of data transferred and the duration of the communication. This will reveal to the snooper a few telling things, for example that the user is frequently in touch with someone or some organization, and this alone might be enough to reveal more than is safe about the user’s life and business:
This is what the vulnerability of https communications is, according to this detailed Wikipedia article on https:
https://en.wikipedia.org/wiki/HTTPS
First, what is https:
“Hypertext Transfer Protocol Secure (HTTPS) is an extension of the Hypertext Transfer Protocol (HTTP). It is used for secure communication over a computer network, and is widely used on the Internet. In HTTPS, the communication protocol is encrypted using Transport Layer Security (TLS) or, formerly, Secure Sockets Layer (SSL). The protocol is therefore also referred to as HTTP over TLS, or HTTP over SSL.
The principal motivations for HTTPS are authentication of the accessed website, and protection of the privacy and integrity of the exchanged data while in transit. It protects against man-in-the-middle attacks, and the bidirectional encryption of communications between a client and server protects the communications against eavesdropping and tampering. The authentication aspect of HTTPS requires a trusted third party to sign server-side digital certificates.”
But on the server (Web site) side:
“… In practice this means that even on a correctly configured web server, eavesdroppers can infer the IP address and port number of the web server, and sometimes even the domain name (e.g. http://www.example.org, but not the rest of the URL) that a user is communicating with, along with the amount of data transferred and the duration of the communication, though not the content of the communication.”
“Web browsers know how to trust HTTPS websites based on certificate authorities that come pre-installed in their software. Certificate authorities are in this way being trusted by web browser creators to provide valid certificates. Therefore, a user should trust an HTTPS connection to a website if and only if all of the following are true:
The user trusts that the device hosting the browser and the method to get the browser itself, is not compromised (i.e., a supply chain attack)
The user trusts that the browser software correctly implements HTTPS with correctly pre-installed certificate authorities.
The user trusts the certificate authority to vouch only for legitimate websites. (i.e., the certificate authority is not compromised and there is no mis-issuance of certificates.)
The website provides a valid certificate, which means it was signed by a trusted authority.
The certificate correctly identifies the website (e.g., when the browser visits “https://example.com”, the received certificate is properly for “example.com” and not some other entity).
The user trusts that the protocol’s encryption layer (SSL/TLS) is sufficiently secure against eavesdroppers.”
So maybe one should keep the above in mind when doing something private on the Web that better stays private. From shopping on line to … dating online?
Ex-Windows user (Win. 98, XP, 7); since mid-2017 using also macOS. Presently on Monterey 12.15 & sometimes running also Linux (Mint).
MacBook Pro circa mid-2015, 15" display, with 16GB 1600 GHz DDR3 RAM, 1 TB SSD, a Haswell architecture Intel CPU with 4 Cores and 8 Threads model i7-4870HQ @ 2.50GHz.
Intel Iris Pro GPU with Built-in Bus, VRAM 1.5 GB, Display 2880 x 1800 Retina, 24-Bit color.
macOS Monterey; browsers: Waterfox "Current", Vivaldi and (now and then) Chrome; security apps. Intego AV
