4 ms·
It can. The domain name is not sent in the clear in an HTTPS request. Instead, the connection is opened against the IP address and the domain name is moved to a
by goldbrick 11y ago
It can. The domain name is not sent in the clear in an HTTPS request. Instead, the connection is opened against the IP address and the domain name is moved to a Host: header which is encrypted.
- esailija 11y agoSNI sends the server name in plain text
- goldbrick 11y agoCorrect (I considered explaining SNI but ultimately didn't bother), and a determined attacker could probably figure out a large number of the sites you visit by the IP as well.
- orthecreedence 11y agoRight, and even still it's pretty trivial to reverse a domain from an IP address in most cases.