4 ms·
I noticed some sites use a subdomain for securedrop. Does that reveal that they're visiting the securedrop page, or not?
by mtgx 10y ago
I noticed some sites use a subdomain for securedrop. Does that reveal that they're visiting the securedrop page, or not?
- jnbiche 10y ago> Does that reveal that they're visiting the securedrop page, or not? Potentially, if they're using TLS/SSL with SNI.
- fennecfoxen 10y agoJust as true if they're using the real domain with a dedicated IP, right?
- deleted 10y ago[deleted]
- jnbiche 10y agoNope, if they're not using SNI, you'd just see the IP address. Fire up Wireshark some time when you're browsing and watch what comes through.
- fennecfoxen 10y ago> Nope, if they're not using SNI, you'd just see the IP address. but that's my point... if you're not using SNI, there's only one SSL server on that IP address, and if reverse-DNS fails you, you can connect on port 443 and ask it for its certificate and it will give it to you...
- detaro 10y agoYes, both through DNS requests (although one maybe could somewhat mitigate that by having each visit to the main domain trigger requests to the subdomain, a) creating traffic and b) putting it in peoples' DNS caches) and HTTPS (All modern browsers include the domain via SNI). It still might be a better choice, given that the main domain for many sites goes through CDNs and more complex systems in general, increasing the risk of compromise there (which also would expose network details about the submitter, and possibly even more)? A dedicated securedrop site hopefully has dedicated infrastructure and better security.