I have several doubts regarding the HTTPS protocol:
- First: Are the HTTPS headers encrypted? I mean, HTTPS encrypts the content, but does it also encrypt the headers?
-Second: Navigating with, for example, Chrome, through the HTTPS protocol, is it safe for privacy? I mean, imagine that the police are analyzing my network traffic through a sniffer. I am browsing with a normal browser but through an HTTPS page, can the police track me? And Can the police know the server to which I am sending data?
Third: The main purpose of Tor is to hide the user through the three nodes. But my question is: If using HTTPS only the connection is encrypted, and the HTTP headers are encrypted, how can the user be tracked if everything is encrypted?
Four: Does using HTTPS also encrypt IP?
Thank you.
Forget my English, English is not my mother tongue.
I add more doubts...:
I have just opened this thread as a result of this animation (https://www.eff.org/pages/tor-and-https). That animation is very explanatory, but it also gives me doubts.
First: According to that image, if I only surf with HTTPS, people (Police, NSA ...) can track me. At first, I thought that maybe they could track me because of HTTP headers. But now I know that HTTP headers are encrypted in HTTPS. So I guess they can track me, for example, thanks to the IP, which is not encrypted (among other elements, like cookies or fingerprinting). Right?
Second: According to that image, when I navigate through HTTPS, the Police or the NSA can know to which web page I am connecting. Our fellow canonizing ironize has said that "they know who you are and what site you are using (because) the site you are connecting to is not encrypted. The resource you're fetching from the site is". I do not quite understand this. I mean, if the HTTP headers are encrypted, the "Host" request header is also encrypted. So how do they know the site I'm connecting to?
Third: Look at the animation (https://www.eff.org/pages/tor-and-https), please. These next questions are very important.
A) If I am using Tor and HTTPS simultaneously, according to the image, if there is a hacker monitoring my router he only receives one information: "Location Tor". What does this mean? He can not see my information (is encrypted because of HTTPS), but does he know my identity? (Imagine that the hacker is monitoring a router in a huge building with many routers. The hacker does not know exactly which router he is monitoring, he only knows that it is in that building. If I use Tor and HTTPS, the hacker can see my real public IP? I say it because the information has not gone through the three nodes yet...).
B) According to the image, if I use Tor and HTTPS simultaneously, my ISP and a possible NSA agent that monitors the Network BEFORE the first Tor node, can see the same thing as before: "Location Tor ". Can anyone explain this to me? What does it mean? I think it means that he can know WHO the information comes from, but not WHERE TO GO. But this means that Tor is vulnerable ... In the same way, the first Tor node can see "Location Tor" ... What does this mean?
C) According to the image, if I use Tor and HTTPS simultaneously, the third Tor node, as well as a possible NSA agent located AFTER the three nodes; the ISP of the site that I connect to and the website can see the site to which a Tor user connects ("Site.com") and nothing else, right? That is, they can see the site to which a connection is connecting, but they can not know where the connection is coming from, right?
D) Imagine this situation ... I am using Tor. The NSA is monitoring ALL submarine cables, as Snowden suggested ... Okay. Then, there is an NSA agent monitoring the Network BEFORE the first Tor node and another monitoring the Network AFTER the third node. They detect all my traffic. According to the image, the first agent receives "Location Tor", and the second agent receives "Site.com" (the website to which I connect). If they share the information, can they know my identity?
I know there are a lot of questions ... I'm sorry, but I think they're interesting. Thank you.
(Forget my English please; English is not my mother tongue).
