3 ms·

IP and port are required for routing, and as such aren't protected. The hostname is (usually) exposed through DNS, and is required for the server to know which

IP and port are required for routing, and as such aren't protected. The hostname is (usually) exposed through DNS, and is required for the server to know which certificate to send. Also, usually (almost) everything is exposed on the first request, before the server has got the chance to redirect to the encrypted version. At that point, the ISP/interceptor could just replace the redirect...

cyphar 11y ago
> IP and port are required for routing, and as such aren't protected. > The hostname is (usually) exposed through DNS, and is required for the server to know which certificate to send. SNI solves this problem. > Also, usually (almost) everything is exposed on the first request, before the server has got the chance to redirect to the encrypted version. At that point, the ISP/interceptor could just replace the redirect... Admittedly, this is somewhat of a culture issue. I haven't read the DNSSEC spec, but it'd be cool to be able to specify redirects using DNS or smth. But at the end of the day, after that first connection (or preferably, it's already setup with HSTS preinitialized in your browser) you're never not going to be using HTTPS without scary warnings (assume the site admin has set up TLS properly).