Can Wi-Fi Owners See Your Google Search History? HTTPS, DNS, SNI and ECH Explained
A short social media video went viral when a man complained on camera that no one had warned him Wi-Fi owners could see other users' search history. Influencer Kate Sarian reposted it with the comment that this was how privacy invasion looked today, prompting many users to question their assumptions.
Cybernews investigated the claim on 11 August 2026 and spoke with network engineers. The engineers stated that the panic was largely overstated, although not entirely unfounded.
What Physically Passes Through the Router
When a user types a Google search, the browser creates a URL of the form https://www.google.com/search?q=.... Until the connection enters TLS encryption, the path, query parameter, headers and cookies travel in plaintext. Once inside TLS, the router sees only the destination IP address, connection duration and data volume. No actual search terms are visible.
Three main metadata sources remain observable. Classic DNS queries on port 53 reveal domain names in plaintext. The Server Name Indication (SNI) field inside the TLS handshake also discloses the target domain. Finally, the router records MAC addresses, DHCP hostnames and connection timestamps, often displaying friendly names such as “iPhone of Natasha”.
ECH and the Last TLS Gap
After years of development, Encrypted Client Hello (ECH) was standardized as RFC 9849 on 3 March 2026. The mechanism hides the real domain name behind an outer unencrypted ClientHello that points to a CDN such as Cloudflare. Mozilla and Google Chrome added support in recent versions, yet Russian regulators began blocking ECH traffic in November 2024, causing widespread outages for ordinary sites hosted on Cloudflare.
The following table summarises visibility under different configurations:
- HTTPS + plain DNS: search text hidden, domain visible via DNS and SNI
- HTTPS + DoH/DoT: domain hidden from DNS but still revealed by SNI
- HTTPS + DoH + ECH: only the CDN operator visible
- Plain HTTP: full URL and search text may be readable
- VPN: local network sees only the VPN server
- Managed device with TLS proxy: full visibility possible
When Requests Are Actually Readable
The only practical cases where an administrator can read search queries involve either unencrypted HTTP (now under 5 % of traffic) or a corporate device that has had a root certificate installed by the organisation. In the latter scenario, the browser trusts the proxy certificate and the proxy can decrypt and inspect all traffic.
Google settled the Brown v. Google lawsuit in 2024, agreeing to update its Incognito mode warnings. The mode never hid activity from network administrators or employers.
Additional Observers in the Chain
Internet service providers in Russia must retain metadata for up to three years under the Yarovaya law package. Public Wi-Fi operators are required by Federal Law 97-FZ to identify users via passport or phone number. Search engines themselves receive every query in plaintext when the user is logged in.
Practical advice includes enabling DoH or DoT, keeping router firmware updated, avoiding installation of untrusted certificates, and using a reputable VPN when stronger protection is required.
Related articles
WhatsApp Help Pages Hid Secret Instructions Directing AI Bot to Avoid GDPR References
Researchers at Redact discovered hidden instructions embedded in WhatsApp's public help documentation that instructed the company's AI support chatbot to avoid recommending users contact data protection regulators. The instructions also prohibited the bot from referencing GDPR, LGPD, or CCPA when users mentioned legal proceedings or lawyers. The findings emerged after Redact analyzed 545 help pages and identified 102 concealed blocks across 80 of them. One directive explicitly told the bot not to suggest contacting supervisory authorities even when users had lost access to their phone number and could not delete their account, despite WhatsApp's own European privacy policy stating that such complaints are permitted. WhatsApp confirmed to WIRED that the blocks were intended solely for its internal chatbot and attributed their public exposure to an error. The company stated the restrictions aimed to prevent the bot from offering legal advice. All hidden blocks were removed by October 18.
WhatsApp Secretly Instructed AI Support Bot to Suppress References to Data Regulators and Privacy Laws
Investigators discovered hidden instructions embedded in WhatsApp's public help pages that directed the company's AI chatbot to avoid recommending users contact data protection authorities. The instructions also prohibited the AI from citing privacy regulations such as GDPR, LGPD, or CCPA, even when users raised these topics themselves. The directives appeared on pages about account deletion and complaints, remaining invisible to human visitors but delivered to crawlers and the AI model. WhatsApp later confirmed the text was intended for its internal support chatbot and attributed the exposure to an error that has since been corrected. The findings highlight a gap between the company's publicly stated privacy policy and the operational guidance given to its AI systems.
Developer Builds Password Manager with Plausible Deniability Using Argon2id and XChaCha20-Poly1305
A Java backend developer rewrote a personal password manager originally built with Electron and React, migrating it to Tauri and Rust while redesigning its storage to support plausible deniability. The new implementation derives keys with Argon2id using a single per-install salt and encrypts files with XChaCha20-Poly1305, storing only random 32-character hex filenames without any headers or magic bytes. Multiple decoy vaults of identical size are created automatically for every user, and all files in the folder receive synchronized timestamps to eliminate metadata-based identification of the active vault. History and sync data are stored as additional encrypted files of the same format, making it impossible to distinguish real from decoy vaults from the filesystem alone. The approach mirrors VeraCrypt hidden volumes but operates on ordinary files and folders, with the explicit goal of providing deniability when a user is compelled to reveal a password.
LxBox Evolves from VPN Client to Comprehensive Network Traffic Management Ecosystem
LxBox has grown from a personal Android client for sing-box into a full ecosystem spanning mobile, desktop, and router platforms. The project now supports a wide range of VPN and proxy protocols within a single routing framework, allowing users to manage corporate SSL VPNs, home WireGuard connections, and proxy servers together. Key security features include default ingress blocking to prevent unauthorized reverse connections through VPN tunnels and protections against traffic leaks via excluded applications. The developer introduced progressive configuration levels, from one-click WARP setup to advanced JSON editing and AI-friendly documentation. The core sing-box-lx fork ranks among the top sing-box derivatives and powers third-party tools such as the upcoming NekoBox 6. LxBox is available on Google Play, F-Droid, and GitHub, with desktop launcher support for Windows 7 and later, macOS, and Linux.