What Can Your Network See When You Use a Proxy?
Separate the proxy connection, destination TLS, and DNS traffic when deciding what an observer on your network can see.
With an ordinary HTTP proxy, your local network can see the initial CONNECT destination even when the website request is protected by HTTPS. TLS to the proxy changes that exposure on the client-to-proxy link.
| Route | Visibility to an observer with access to the local traffic |
|---|---|
| Plain HTTP website through a plain HTTP proxy | The application exchange travels in readable form, beyond just the proxy address. |
| HTTPS website through a plain HTTP proxy | The cleartext CONNECT authority, proxy connection and timing are observable; destination TLS protects the website request inside the tunnel. |
| A correctly verified HTTPS proxy connection | TLS protects the proxy exchange on that segment; the endpoint connection and traffic metadata remain observable. |
Protection on that link does not remove the proxy operator's view of its own connection handling. Destination TLS and operator trust are separate parts of the route.
DNS also needs its own check. A locally resolved target name does not automatically move inside the proxy connection. Remote SOCKS resolution changes that lookup, while background processes and other applications can still resolve names and connect independently.
For a useful privacy assessment, record the proxy URL scheme, destination scheme, actual client route and DNS behavior. One browser setting cannot establish coverage for the whole device. At the destination, a signed-in request can still identify its account through cookies even if the local link is encrypted and the exit IP changed.