5

I read this article which says github is being blocked in Russia because a single controversial page hosted on it can't be blocked because of HTTPS.

So I'm trying to determine if that implies that my local sys-admin can't keep track of my browsing history....

Though domains name would be visible to anyone in the middle, are the other parts of the requested URI encrypted, or can the ISP (or whomever is in the middle) see which folders/files on the domain I've requested (or are they encrypted)?

Ƭᴇcʜιᴇ007
  • 113,841
anuj_io
  • 153

2 Answers2

6

Your local sys-admin can track your browsing history if they can get you to install a certificate on your (or their machine) - in which case they can man-in-the-middle your connection.

If you have your own device and are sure they don't have a certificate, the best they can do is get a feel for what sites you are going to by looking at the IP address of the sites and the traffic profile (ie lots of traffic could imply downloading of videos), and IP addresses of big sites normally have reverse lookup. They can also use DNS records to find the DNS you requested if you are using their DNS servers which is likely.

If the sysadmin does not have access to your machine to install the cert or local software, they can't use the network to see what page(ie folder) you are going to in the site as this is encrypted (This information is sent in the header of your request, which happens after SSL is negotiated).

Source: I am a system administrator who handles sites with HTTPS and from time-to-time manually do HTTP / HTTPS requests to check corner cases.

davidgo
  • 73,366
2

So my does it imply that even my local sys-admin can't keep track of my browsing history too?

No, not necessarily. A sysadmin can perform a man in the middle attack if they put a custom certificate on the client computer.

If you click on the lock icon in the address bar of a secure site at home, it will say who the certificate issuer is and what the private key is. If you perform the same action at work and it says the same information - you are probably safe. If it does not, that's a huge red flag that someone may be intercepting your traffic.

As you said, they do know what websites you are visiting because of DNS - just not what is being transferred.

EDIT: To clarify, because of dns they know what SERVERS you are visiting, but not the entire URI.

Arthur
  • 1,155