4 ms·
Why isn't all HTTPS traffic being declared this way (hiding the real endpoint)? Is there any downside doing this?
by philfrasty 10y ago
Why isn't all HTTPS traffic being declared this way (hiding the real endpoint)? Is there any downside doing this?
- firloop 10y agoSNI requires the hostname to be sent over the wire as plaintext. The reason why SNI is useful is because it allows one server to host many HTTPS domains. Perhaps some innovation to SNI would fix this problem. https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication
- endymi0n 10y agoThis. The current advent of the encrypted web would not have been possible without SNI - the costs for exclusive IPv4 addresses (especially when using a CDN) would have been prohibitive. SNI isn't as much as a security risk if you consider that before resolving, you usually need a DNS request too - which would expose the endpoint to your ISP anyway.
- tedunangst 10y agoThe server doesn't know which certificate to present to the user unless the user provides some hint as to which endpoint is desired.
- Buge 10y agoThis only works because the same company is hosting the content (appspot) as the fronting domain (google.com). Google terminates the TLS then looks at the host header to see where to send it. I couldn't hide my website behind facebook, because my website and facebook are not behind the same TLS terminator.