Hacker News new | ask | show | jobs
by bobajeff 2940 days ago
>That means that your ISP can still figure out which sites you’re visiting, because it’s right there in the server name indication. Plus, the routers that pass that initial request from your browser to the web server can see that info too.

Well there goes the interest I had in this.
2 comments
patrickmcmanus 2940 days ago
we're coming after SNI too. One step at a time.

(also, 1] dns leaks are worse than sni leaks as typically more people are exposed to the dns query and 2] HTTP/2 can carry more than one hostname on a connection so some hostnames that appear in dns are never leaked through sni.)

link
tialaramex 2940 days ago
The TLS WG currently has only a problem statement for Encrypted SNI. Even the weak selection of two possible ways forward didn't achieve consensus as I understand it.

I don't see any way to have encrypted SNI without paying a price of one additional round trip. That's a fair price for something you must have, but for anybody to benefit we must insist everyone use it always, or adversaries will simply block it. And a round trip is a high price for users who don't (believe they) need this.

link
azdle 2940 days ago
Well, when there's two issues, one needs to be fixed before the other.
link