4 ms·
In the article,testing the host header with different IP is done over http and not https.so i so it does not prove that Airtel is sniffing https traffic,isn't
by hitr 10y ago
In the article,testing the host header with different IP is done over http and not https.so i so it does not prove that Airtel is sniffing https traffic,isn't it ?
>curl -H "Host: thepiratebay.org" http://192.30.253.112/ http://192.30.253.112/
May be I missed something. Technically it is possible block the traffic by looking at SNI[1] or simply block the ipaddress if it belongs to the blocked site.I always thought that every ISPs had to follow this because all ISPS are asked to block a list of such sites by the Supreme Court .
[]1 https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication
- Manishearth 10y agoIt can't sniff https traffic, except for basic metadata. The point is that many sites using cloudflare talk to cloudflare over HTTP (while users get HTTPS), and airtel is sniffing that.
- kekub 10y agoIt is possible for them to block the access to such a site using SNI, however they will not be able to do a man-in-the-middle attack (as it would be possible in this scenario) unless they could obtain a valid certificate for the site.
- userbinator 10y agoI wonder if there's any proposals/extensions for moving SNI into the encrypted part of the communication. The initial certificate would have to be keyed to the IP address of the server, or maybe something from DNS, and probably there are other complications too, but it'd at least reduce the amount of plaintext information transmitted with each connection.
- deleted 10y ago[deleted]
- NetStrikeForce 10y ago> moving SNI into the encrypted part of the communication. That's called host header :-)
- gnurag 10y agohah, i was wondering the same :)
- stanleydrew 10y agoFor HTTP, yes. There are thousands of other protocols that rely on TLS though.
- captn3m0 10y agoAre there any other protocols that rely on SNI? Genuinely curious.
- prdonahue 10y agoThis has been discussed ad nauseum on the TLS-WG mailing list. Just search for "encrypted SNI". Or click here for ekr's initial email: https://www.ietf.org/mail-archive/web/tls/current/msg18633.html https://www.ietf.org/mail-archive/web/tls/current/msg18633.h....
- dfox 10y agoMoving SNI into the encrypted channel would require completely redesigning TLS's key negotiation mechanism.
- sp332 10y agoThe server wouldn't know which key to use to decrypt the rest of the message.