If I go to https://paypal.com/ and login, can Eve find the approximate size of the HTTPS request from my browser? Can she see the approximate size of the responses from the paypal server to me? and also can she see that I am visiting paypal.com in particular? To what extent does SSL protect you?
Eve can see the size of the HTTPS request and response, as well as the domain and subdomain you connect to (via rDNS lookup or via SNI sniffing). TLS only protects the precise content of the data being transmitted, not where it is going. In particular, it works like this:
https://foo.example.com/some/page.html#some-fragment | proto | domain | path | fragment |
- proto - There are only two protocols in common use, HTTP and HTTPS.
- domain - The domain is example.com and *.example.com, detectable with rDNS or SNI.
- path - The path is completely encrypted and can only be read by the target server.
- fragment - The fragment is visible only to the web browser and is not transmitted.
The attacker can see the protocol and domain, but not the path or the fragment. I wrote a more detailed answer about this on Information Security.