HTTPS, DNS, and what still leaks
A padlock hides page contents. It does not hide your IP or every name you ask for. Know the layers.
HTTPS puts a lock on the contents of a page. DNS is how a name like knowyouripaddress.com becomes an address your computer can call. Together they decide what is private on the wire and what still leaks. Cyber security conversations that stop at “the padlock is on” leave half the picture out.
What HTTPS hides and what it does not
TLS encrypts the HTTP request and response between your browser and the site. A café should not read your password on a modern login page. A padlock also means you are talking to whoever holds the certificate for that host — which is why phishing sites can have padlocks too. The lock is not a badge of virtue. It is a badge of encryption to that name.
HTTPS does not hide that you visited the host. The IP you connected to, the SNI that often still names the site, and the timing are visible to the network in the middle. Encrypted Client Hello and similar work are changing this, slowly. Do not assume the ISP is blind.
Your public IP is still on every connection. The site sees it. This site exists so you can see it too. A VPN changes which IP the site sees and wraps DNS in many setups. That is a different layer.
DNS is a list of questions
When you type a name, something must resolve it. Your ISP’s resolver is the default. It can log those questions. A hostile network can lie in the answers and send you to the wrong IP. Encrypted DNS (DoH or DoT) makes the questions harder to read on the local path. It does not hide them from the resolver you chose. You picked a new librarian.
If a VPN is on, DNS should go through the tunnel. If it does not, you have a leak: the ISP still sees the names while the web traffic takes another path. Leak tests exist. Use one after you install a VPN.
Cookies, accounts, and the site’s own eyes
Encryption on the path does not stop a site from setting cookies, fingerprinting the browser, or tying visits to a login. Logged-in privacy is a policy problem, not a TLS problem.
Clearing cookies helps against some trackers. It does not change your IP. It does not reset a fingerprint. Combine tools instead of worshipping one padlock.
Practical choices
- Prefer HTTPS. Type the address or use a bookmark for money and mail.
- If you use a VPN, confirm DNS is not still talking to the café.
- Treat a padlock on a weird domain as encryption, not as trust.
- Remember the IP is a label on the outside of the envelope.
The web got much better when HTTPS became normal. The remaining leaks are names, IPs, and the stories you tell when you sign in. Know which layer you are fixing, and you will not expect a certificate to do a VPN’s job — or a VPN to do a password manager’s.