3 ms·
Most of the time the domain name will be sent in the clear anyway. For example, when you connect to a plain HTTP site, the domain name will probably be included
by netheril96 11y ago
Most of the time the domain name will be sent in the clear anyway. For example, when you connect to a plain HTTP site, the domain name will probably be included in the "Host" field. When connecting to a HTTPS site, it will probably be included in the Server Name Indication extension field during TLS handshake.
Of course there are many times the domain name will remain hidden, if the DNS record is encrypted, but that is not a fraction of total use cases, and I doubt there will be great force pushing for DNS encryption.
- gwu78 11y agoI try to avoid SNI and thankfully find a very small percentage of SSL-enabled sites using it, overall. I sniff my own SSL traffic and can see all the domain names for which SNI is being used. Are you saying SSL leaks the domainname in every request? What is the justifcation for SNI? Does it have to do with conserving IP address space? Not sure I understand your comment about HTTP Host: field and plain text HTTP traffic. My question was that if HTTP traffic is encrypted (e.g., via SSL) then why not encrypt DNS, too?
- talideon 11y agoSNI is useful because it's less of a headache than setting up multiple network interfaces. Conserving IP address space is simply something really nice you get for free.