How is HTTPS browsing history monitored?

I am researching on how to monitor HTTPS browsing history. I am not a network person, so apologies if I sound ignorant in this issue. I googled the following questions below, but nothing substantial came up:

• HTTPS session tracking
• How are data collected from HTTPS websites?
• how are https websites monitored?

So what I've researched on HTTPS is that it is Confidential. The visitor’s connection is encrypted, obscuring URLs, cookies, and other sensitive metadata.

My question is, can those data and information be tracked and collected and if so, how is it possible?

Also, with HTTPS websites, can you see where are how long are people going to these websites?

If you guys could point me in the right direction, it would really help!

1 Answer

HTTPS (HTTP over TLS) provides security while data is moving between the user agent (your browser) and the web server. That's it. It doesn't protect data on the client or server.

HTTPS also only works if done entirely correctly.

Also, with HTTPS websites, can you see where are how long are people going to these websites?

If you can sniff the network traffic, you can see the domain names / IP addresses that they visit, even if using HTTPS. You can see the time and size of every request and response. You cannot see URL paths or query strings or headers or bodies. But you can make inferences about them based on the size.

My question is, can those data and information be tracked and collected and if so, how is it possible?

In some cases yes you can be tracked. Some methods include:

1. Get access to the client computer (physical/malware/governmental)
2. Get access to the server computer (physical/malware/governmental)
3. SSLStrip
4. Exploit a flaw in TLS (BREACH, CRIME, Logjam, goto fail, Heartbleed, Freak, Poodle, etc)

What to do about it:

1. Use a dedicated computer for important activities (like banking, healthcare), to avoid getting malware from less important activities, and lock it in a safe
2. Use to see if the servers you use are reasonably secure
3. Test your browser too:
4. Use a browser with a built-in sandbox (Chrome)