A short social media video went viral when a man complained on camera that no one had warned him Wi-Fi owners could see other users' search history. Influencer Kate Sarian reposted it with the comment that this was how privacy invasion looked today, prompting many users to question their assumptions.
Cybernews investigated the claim on 11 August 2026 and spoke with network engineers. The engineers stated that the panic was largely overstated, although not entirely unfounded.
What Physically Passes Through the Router
When a user types a Google search, the browser creates a URL of the form https://www.google.com/search?q=.... Until the connection enters TLS encryption, the path, query parameter, headers and cookies travel in plaintext. Once inside TLS, the router sees only the destination IP address, connection duration and data volume. No actual search terms are visible.
Three main metadata sources remain observable. Classic DNS queries on port 53 reveal domain names in plaintext. The Server Name Indication (SNI) field inside the TLS handshake also discloses the target domain. Finally, the router records MAC addresses, DHCP hostnames and connection timestamps, often displaying friendly names such as “iPhone of Natasha”.
ECH and the Last TLS Gap
After years of development, Encrypted Client Hello (ECH) was standardized as RFC 9849 on 3 March 2026. The mechanism hides the real domain name behind an outer unencrypted ClientHello that points to a CDN such as Cloudflare. Mozilla and Google Chrome added support in recent versions, yet Russian regulators began blocking ECH traffic in November 2024, causing widespread outages for ordinary sites hosted on Cloudflare.
The following table summarises visibility under different configurations:
- HTTPS + plain DNS: search text hidden, domain visible via DNS and SNI
- HTTPS + DoH/DoT: domain hidden from DNS but still revealed by SNI
- HTTPS + DoH + ECH: only the CDN operator visible
- Plain HTTP: full URL and search text may be readable
- VPN: local network sees only the VPN server
- Managed device with TLS proxy: full visibility possible
When Requests Are Actually Readable
The only practical cases where an administrator can read search queries involve either unencrypted HTTP (now under 5 % of traffic) or a corporate device that has had a root certificate installed by the organisation. In the latter scenario, the browser trusts the proxy certificate and the proxy can decrypt and inspect all traffic.
Google settled the Brown v. Google lawsuit in 2024, agreeing to update its Incognito mode warnings. The mode never hid activity from network administrators or employers.
Additional Observers in the Chain
Internet service providers in Russia must retain metadata for up to three years under the Yarovaya law package. Public Wi-Fi operators are required by Federal Law 97-FZ to identify users via passport or phone number. Search engines themselves receive every query in plaintext when the user is logged in.
Practical advice includes enabling DoH or DoT, keeping router firmware updated, avoiding installation of untrusted certificates, and using a reputable VPN when stronger protection is required.
