Can the lengths of HTTPS requests be used to deduce which public pages on a site are visited?
Yes, you can often learn a lot just from the length of encrypted data (more generally the segmentation pattern of an encrypted stream). All the attacks that I know about leverage the data-dependent effects of compression.
It sounds like your question covers both HTTP requests and responses. There are indeed attacks that target exactly this side-channel. See the discussion here:

CRIME attack: if the user's HTTP requests support compression (which is possible as a TLS option) then private cookie data can be stolen by causing the victim to make many HTTP requests that include attacker-controlled content, and then measuring the size of the resulting (compressed) requests.

BREACH attack: Similar but works on the HTTP response.


Regarding the length of HTTP responses, here is a proof of concept showing how the length of different images from Google Maps can be used as a &quot;fingerprint&quot; of what area you are browsing.
This one is probably the simplest example of this kind of attack, and closest to the simple fingerprinting thing you describe:

Vincent Berg: I can still see your actions on Google Maps over SSL


The same concepts generalize to encrypted streams. When the compression uses variable-bitrate encoding, it leads to different segmentation/burst timing patterns.

You can recover actual spoken text from an encrypted VoIP audio stream:

Andrew M. White, Austin R. Matthews, Kevin Z. Snow, Fabian Monrose: Phonotactic Reconstruction of Encrypted VoIP Conversations:
Hookt on fon-iks. IEEE S&amp;P 2011


You can identify the movie being watched (e.g., over Netflix, Youtube, etc):

Roei Schuster, Vitaly Shmatikov, Eran Tromer: Beauty and the Burst: Remote Identification of Encrypted Video Streams. USENIX 2017
Andrew Reed, Michael Kranch: Identifying HTTPS-Protected Netflix Videos in Real-Time. CODASPY 2017