camos are dopest <| sep |> This is all well and good , but HTTPS is not enough . Edit reversing the order of paragraphs , most important first . Fourth , the website itself knows what you are doing obviously . When that website is some giant corporate monster search engine , webmail , then it can know a lot about you , HTTPS be dammed . And of course , some of them can be subpoenaed . Third , the website you are visiting often have trackers , such as the like button or Analytics now Facebook and Google know exactly which page you are visiting , and may even know how you are visiting them . Second , while the content of your communication is certainly hidden , the metadata isn ' t you still reveal which website you are visiting , when you are visiting it , and how much you ' re downloading . It ' s even worse when part of the content comes from some content delivery network , ad network , and so on gives the attacker even more information . First , there is the good old man in the middle . Your communication got intercepted for some reason , and either the attacker produced a legitimatelooking certificate with a bogus or corrupt certificate authority , or you clicked through the warning without paying attention . Game over . Want actual privacy ? Start decentralising the internet again . This probably means replacing the web .