You open a website, see the padlock icon in your browser, and feel confident that your connection's content is secure. That is true. But researchers have found that sometimes simply observing the sizes and rhythms of network packets is enough to identify even a specific page.
Imagine this scenario.
You visit a major news site. You read an article, close it, and open another. Both pages use HTTPS. No outside observer can see their text, photographs, or the full page address.
Yet every page load has its own unique network pattern.
One article contains twenty photos. Another features a long text with a single illustration. A third loads video, comments, and extra assets.
The volume of data differs. The transmission speed differs. Even the sequence of requests turns out differently.
It is precisely these differences that make it possible to attempt to identify which page a person has opened.
Encryption protects the content, but not the entire connection
When a browser establishes a secure HTTPS connection, the content of the requests and responses is encrypted.
An outside observer cannot simply read the text of an article or see a submitted password.
However, certain characteristics of the connection remain visible:
- how much data is being transferred;
- the direction in which the packets are moving;
- how often they arrive;
- when bursts of activity occur;
- how long the download takes.
This information is known as network metadata.
Imagine that an observer has studied one hundred pages of a single website in advance and recorded the characteristic network pattern of each one.
When someone opens one of those pages, a machine learning system can compare the new pattern against the known samples.
This is how website fingerprinting works.
An important point: the neural network does not decrypt HTTPS. It attempts to guess the content based on indirect indicators.
Researchers tested just how serious this is
In September 2026, a team of specialists from the CISPA Helmholtz Center for Information Security presented a study on the potential of HTTP/2 to defend against this type of fingerprinting.
The researchers examined pages from five major resources: Amazon, BBC, Reddit, Udemy, and Wikipedia.
For each site, they selected one hundred pages and investigated the characteristic features of their network traffic.
Without additional protection, machine learning algorithms in controlled experiments frequently showed very high recognition rates.
Another study, published in April 2026 in the journal Scientific Reports, demonstrated 97.4% accuracy for one of the classification scenarios involving unencrypted traffic.
But a clarification is necessary here.
97.4% is not the probability that a provider will figure out any page of any user.
This is the result of a laboratory experiment in which the system chose among pre-selected, known options.
On the real internet, there are billions of pages, constantly changing content, background connections, and many other factors. Therefore, laboratory accuracy cannot be directly translated to real-world surveillance.
Nevertheless, the very possibility of recognition has been confirmed experimentally.
What does HTTP/2 have to do with it?
HTTP/2 is one of the protocols that browsers and servers use to exchange data.
It allows multiple data streams to be transmitted within a single connection, manages transmission priority, and distributes available bandwidth.
Normally, these features are needed to speed up website loading.
However, the researchers suggested using them for privacy protection as well.
For instance, one can change the transmission order of individual resources, distribute streams differently, or manage the pace at which data is sent.
As a result, the exact same page stops producing an identical network pattern every time.
It becomes much harder for a recognition algorithm to match the observed traffic to a specific page.
What is particularly interesting is that such mechanisms could potentially be implemented at the web application level without creating a brand-new VPN protocol.
And how well does this protection work?
The researchers tested several traffic-modification methods and compared them with existing techniques.
In some experiments, after applying the protection, an observer could no longer confidently single out a single page: dozens of plausible options remained.
At the same time, certain HTTP/2-based approaches made it possible to significantly reduce additional latency and data overhead compared to other defensive methods.
This is important because privacy comes at a price.
If you constantly send redundant data or artificially delay packets just to mask activity, websites will start loading slower, and users will consume more data traffic.
The researchers' goal is to find a balance between security and normal connection speeds.
For now, these are experimental methods rather than a feature you can simply enable with a single click in your browser.
Does this mean VPNs can be recognized too?
Here, it is necessary to separate two different tasks.
The first is determining that a person is using a VPN.
The second is attempting to figure out which sites or pages they are visiting inside that encrypted connection.
These are not the same thing.
When a user connects to a VPN, their local provider typically sees the connection to the VPN server, but does not directly see all the destination sites the user accesses through the tunnel.
However, the total volume, timing, and rhythm of data transmission may remain observable.
Under certain conditions, these signs can also allow assumptions to be made about a user's activity.
At the same time, the HTTP/2 study primarily looked at standard HTTPS connections without an additional VPN tunnel. It does not prove that the proposed protection can hide a VPN from DPI.
To recognize the tunnels themselves, other indicators are used: protocol features, network addresses, packet sequences, and connection characteristics.
Therefore, good masking of a single indicator does not guarantee the invisibility of all traffic.
What does this mean for the average user?
First of all, you should not abandon HTTPS. Encryption remains an essential foundation of internet security.
But it is important to understand its limits.
HTTPS protects the content of the connection. A VPN additionally hides the final destinations from the local provider when the tunnel is configured correctly. And defense against website fingerprinting solves yet another task: reducing the amount of information that can be extracted from traffic behavior.
These technologies complement each other rather than replace one another.
For users, practical recommendations remain straightforward: use modern browsers, update applications in a timely manner, choose reliable VPN services, and ensure there are no DNS leaks.
For website and server owners, an additional area of work emerges: studying what information the size and sequence of transmitted resources reveal, and keeping an eye on the development of HTTP/2 and HTTP/3 security technologies.
However, experimental changes to network behavior should not be rushed into production servers immediately. First, compatibility, load impact, and real-world benefits must be evaluated.
The internet enters a new phase of confrontation
In the past, the core question was: can an outsider read the data being transmitted?
Today, another question is increasingly arising: how much can be learned about a person without reading that data at all?
Machine learning makes network behavior analysis more and more effective. At the same time, researchers are finding new ways to minimize information leaks.
That is why the evolution of privacy does not end with the installation of HTTPS or a VPN.
Encryption protects our words. The next challenge is learning to protect the digital footprints left behind them.
Glass Bridge | November 5, 2026
Sources:
- Cebere B. et al. Understanding the Privacy-Preserving Potential of HTTP/2 Against Webpage Fingerprinting. September 2026, ACM CCS 2026. https://arxiv.org/abs/2609.05119
- Alazzam H., Abualganam O., Almobaideen W. Advanced website fingerprinting for detecting VPN-based censorship evasion: a transformer-based approach. Scientific Reports, April 2026. https://doi.org/10.1038/s41598-026-41976-4