Lesson 1 of 4 · 7 min
What happens when you open a website
Follow one click from your Mac to a website and back, and see who is involved along the way.
You type an address, press Enter, and a page appears a moment later. It feels like your computer talks directly to the website. In reality, several machines and companies take part in that moment, and each one learns something about you. Knowing who they are is the first step to deciding what to protect.
The internet is a network of networks
As Mozilla’s developer guide puts it, “the Internet is a large network of computers which communicate all together.” Your Mac joins it through a local network (your Wi-Fi at home, an office network, a café hotspot), which connects to an internet service provider (ISP), which connects to other providers, and so on until the network that hosts the website.
One click, step by step
- Finding the address. Computers reach each other by number (an IP address), not by name. Your Mac first asks a DNS resolver, usually run by your ISP or a public service, “what is the address of example.org?”
- Connecting. Your Mac opens a connection to that IP address. The request travels in small pieces called packets, passed from router to router, each one forwarding it closer to its destination.
- Securing the line. For an address starting with https://, your Mac and the website first agree on encryption keys (TLS), so the content of what follows is scrambled for everyone in between.
- Asking and receiving. Your browser asks for the page; the server sends back the text, images and code, often pulling more pieces from other servers (fonts, videos, analytics, ads).
Who can see what
| Who | What they can usually see | What HTTPS hides from them |
|---|---|---|
| Whoever runs the Wi-Fi or local network | That your device is online, the websites’ IP addresses, and often the site names | The pages you read and what you type |
| Your internet provider (ISP) | The same, plus when and how much you use the connection | The pages you read and what you type |
| The DNS resolver | Every site name your device looks up | Nothing: a plain DNS lookup is not encrypted |
| The website itself | Everything you send it: searches, messages, logins, your IP address | Nothing: it is the other end of the conversation |
| Other services the page loads | That you visited the page, often with identifiers that follow you across sites | Nothing |
The Electronic Frontier Foundation’s Surveillance Self-Defense guide sums up the limit of HTTPS: it “hides which specific page on a website you navigate to—that is, everything ‘after the slash’”, but not that you are communicating, nor details such as “the location, times, and length of communication.” That leftover information is called metadata, and for many people at risk it matters as much as the content.
Key takeaways
- Opening a website involves your network, your ISP, a DNS resolver, the website and the other services it loads.
- HTTPS hides the content and the exact page, not which site you visit or when.
- Metadata (who, when, how often, from where) can reveal as much as content.
- The website itself always sees what you send it.
Check yourself
1. With HTTPS, what can the Wi-Fi owner in a café still usually learn?
- The messages you type into the site
- Which website you are connecting to and when — Right.
- Your passwords
- Nothing at all
HTTPS encrypts the content and the page path, but the destination site and the timing remain visible as metadata.
2. What does your Mac do first when you type a website’s name?
- Sends your password
- Asks a DNS resolver for the site’s IP address — Right.
- Downloads the whole website
- Turns on encryption for the Wi-Fi
Computers connect by IP address, so the name must be looked up first. That lookup is itself visible to the resolver.
3. Who can see the searches you type on a website that uses HTTPS?
- Only your ISP
- Nobody
- The website itself — Right.
- Only the DNS resolver
Encryption protects the path between you and the site, but the site is the other end: it receives everything you send.
Do it with FireAI
Put this lesson into practice on your own Mac.
- Find out where an app sends data, on the World map — See exactly which company and country one app is quietly talking to.
- Deep inspection, without decrypting anything — Get real detail on a secure connection without FireAI ever reading what’s inside it.
- The World map — See where your data actually goes, not just a hostname you’d have to look up yourself.
Sources
- MDN Web Docs: How does the Internet work?
- EFF Surveillance Self-Defense: What Should I Know About Encryption?
Put it into practice on your Mac
Try every feature free for 17 days, no card needed.