How much information can my ISP see?

Question

Is it possible for my ISP to see the passwords that I enter on websites and in chat programs? And what about SSL websites that start with https, do they encrypt my username and password before reaching the ISP?

Answer 1

If you start at an https:// address, everything is encrypted between your computer and the remote server, so your ISP can't intercept any of your data^†*. Your ISP could easily view any non-ssl (http://) connections though.

Note that the firesheep firefox plugin exposed a hole in this mechanism last year. Many websites use https just for your initial login and then switch back to http for the rest of the traffic. In this case your ISP could intercept your traffic after you logged in. Someone else on your local network could also run the firesheep plugin and hijack your session with say facebook and impersonate you.

Most large websites are now transitioning to https all the time to fix this hole. It's not really something you need to worry about on your home network too much, but you should be aware of how this works.

^{† Assuming you're not ignoring certificate warnings, and your computer/browser has not been compromised.}

^{* It can also see the hostname you're requesting from a possibly shared host. Since TLS1.0 the hostname is transmitted in plaintext (SNI)}

Answer 2

I think you might wanna watch the following video from 27th Chaos Communication Congress (CCC):

"How the Internet sees you: demonstrating what activities most ISPs see you doing on the Internet"

1. Info Page
2. Video (embed) and mp4 to download
3. Pdf of the speak

Answer 3

Philiph is right for "If you start at an https:// address, everything is encrypted between your computer and the remote server" with one caveat: all you know with HTTPS is that everything is encrypted between your computer and somewhere else.

There is a risk that your communications could be tampered with at the ISP using a man in the middle attack — and if you think that that can't happen, see the news about Tunisia which shows what can happen if a malicious agent has access at ISP level.

This can only be avoided if:

• A user always uses the correct https:// URL.
• A user does not ignore certificate warnings.
• The user is 100% sure their computer has not been tampered with.

Otherwise, an ISP could tamper with the connection in a way a non-tech savvy user may not notice.

Answer 4

Sure, your ISP (or someone else using their equipment without permission, which is a serious risk in and of itself) could read unencrypted data that goes through their network. Typically, unencrypted traffic includes e-mail, web, and FTP traffic unless specifically encrypted using SSL or TLS, as in the HTTPS protocol.

Also typically, your ISP would prefer that at the very least, the passwords you send over the internet (in particular, for their e-mail accounts) are encrypted, so as to prevent attackers from compromising a router somewhere - like your wireless router with the default password - and gaining access to their servers. While the government could force an ISP to listen to your traffic for their purposes, a much greater threat to you exists from people who would love to steal your private information and/or money.

Answer 5

Not directly an answer to your question, but passwords are more often stolen using either a keylogger (software illicitly installed on your PC that records all your keystrokes) or social engineering, such as phishing. (Phishing is sending email that tricks you into logging into a "fake version" of Facebook or whatever, thus revealing your password to the phishers, and then redirecting you to the real one. Most victims don't even realize at first what has happened.)