how private are RSS feeds?
how private are RSS feeds?
How could anyone find out which sites are you following using an RSS feed? And I mean in a broad way: can the site track you? Can ISP? Network managers?
Let's say you want to follow a bunch of political sites that you don't want to be easily attached to, is RSS a good way to do it? Are there extra precautions to take?
My first thought would be that it's the same as using any other browser, so not a great way to be private. Am I wrong?
The answer is absolutely yes
Keep in mind that RSS is just some XML sent over HTTPS connection. For anyone outside, it will look like gibbirish, they can say you are requesting and getting some things from that particular site but not what it is.
Your client downloads a XML file and parses it and then maybe downloads some images. There.
If the client itself doesn't track you, it's as private as online gets.
An RSS feed is literally the same as going to the website. A request is being made to the domain and anyone who can see the data between you and the website can see it. If you think you're secure going to the website normally, then an RSS feed would be secure, too.
The RSS feed is still fetched from their server. Whoever can watch your internet traffic would still see the connection to the site.
So if you put your RSS feed application behind a vpn it would be more private?
Then, only the vpn provider would see the very same traffic, the ISP would see without vpn.
The ISP would just see your connection to the vpn provider.
The sites themselve would just see the vpn ip.
So it's not the question about whether anyone sees the traffic, but who.
Only Tor would hide this traffic in a sense.
Privacy is not an aspect of an RSS feed. It's just a list of items in a standard format. Your reader requests it from the server, the server sends it. That's it.
My first thought would be that it’s the same as using any other browser, so not a great way to be private. Am I wrong?
It is exactly the same. You can even open the RSS files in your browser directly. They're just XML files served via http(s)
Depends on your threat model. If you use secure DNS and https for the RSS feed, then these people would know your IP and the IP you're connecting to:
- the DNS provider
- the RSS server
- your ISP/ VPN server
Your ISP or VPN will know you've made a TCP connection to that server at a specified port, but that's it. It's trivial for them to reverse lookup the IP back into a name.
Only the RSS server will know the specific URL you're visiting though.