Mobile Networking · Watching Traffic · Lesson 1 of 4

What an Observer Sees

See what a Wi-Fi owner can and can't learn while you browse over HTTPS.

The view from the router

When your phone joins a Wi-Fi network, every bit of data passes through equipment that someone else owns. At a café, that's the café's router. Whoever runs it is an observer, and so is anyone else who controls part of the path, like your internet provider.

HTTPS hides a lot from them. They can't read the pages you load, the messages you type or the passwords you enter. Those travel inside an encrypted tunnel.

Plenty still leaks around the edges. The observer can see metadata, the data about each connection itself:

• when each connection starts and stops
• which server it goes to, by IP address and usually by domain name
• roughly how much data moves each way

That can say a lot. A late-night visit to a clinic's website, followed by a few large downloads, tells a story without a single page being read.

Open the lab to see what the café Wi-Fi owner sees while the phone browses. Tap a few connections and compare what's visible with what stays hidden.

How names slip out

The observer in the lab could see domain names, even though every page was encrypted. There are two main leaks.

The first is DNS. Before your phone connects to mobdojo.com, it looks up the site's IP address, as you saw in Course 1. Ordinary DNS lookups travel unencrypted, so anyone on the network can read the name you asked for.

The second is the start of the HTTPS connection itself. One server can host many websites, so your phone has to say which one it wants before encryption begins. It does this with a TLS extension called Server Name Indication, usually shortened to three letters. Because it's sent before the tunnel is set up, the name is readable.

Both gaps are slowly closing. Encrypted DNS hides lookups, and you'll meet it in Course 5. A newer standard called Encrypted Client Hello hides the server name too, but only when both the browser and the website support it. Many connections today still show the name.

Type the short name of the TLS extension that reveals the site's name.