3 ms·
Is SNI plaintext? I understand that it's part of the TLS handshake[1]. DNSCrypt is just an additional layer of security. You can use a VPN or Proxy along with
by atmosx 10y ago
Is SNI plaintext? I understand that it's part of the TLS handshake[1].
DNSCrypt is just an additional layer of security. You can use a VPN or Proxy along with DNSCrypt & DNSSEC if the purpose is to avoid Gov monitoring.
[1]: https://journal.paul.querna.org/articles/2005/04/24/tls-server-name-indication/ https://journal.paul.querna.org/articles/2005/04/24/tls-serv...
- tptacek 10y agoIf your purpose is avoiding government monitoring, adopting a system like DNSSEC that is essentially a PKI rooted with the world's governments is probably not a great step forward.
- captn3m0 10y agoSNI has to send the server name unencrypted as part of the request during the handshake process. [ref](http://serverfault.com/a/222980/78192 http://serverfault.com/a/222980/78192)
- mike-cardwell 10y agoThe hostname in SNI is sent over plain text yes.
- atmosx 10y agoGood to know, ty.
- deleted 10y ago[deleted]