I wonder how much one can analyze with timings and sizes. If a news article on a known hostname has 5 Xitter embeds and 4 Instagram ones, the Creep in the Middle can count how many bytes are transferred in the HTTPS requests to Xitter/Instagram (there won't be 9 separate TCP connects due to connection reuse), and compare that to its own scrape of news articles of that host...