3 ms·
SSL should prevent that. Sadly, SNI leaks the domain name. Hacker News appears in favor of SNI though, because lack of IPv4 address space. https://news.ycombin
by danjoc 10y ago
SSL should prevent that. Sadly, SNI leaks the domain name. Hacker News appears in favor of SNI though, because lack of IPv4 address space.
https://news.ycombinator.com/item?id=13639112 https://news.ycombinator.com/item?id=13639112
Oddly, HN is really worried about server privacy. If we shared a single certificate across 20 domains, then people could see all those domains are hosted in the same place.
My point? We are part of the problem.
- willstrafach 10y agoSSL does not really keep the domain name private at all either way though. That is no good solution to this, because your ISP needs to know how to route your request, right? Or, am I misunderstanding your point?
- danjoc 10y ago>SSL does not really keep the domain name private at all either way though. Sure it does. That's the whole point of SNI. SSL encrypts the request, including the domain name. If you share a single IP address with multiple vhosts, you have two options. SNI, which leaks the domain in the clear, or a certificate matching all the domains you vhost. https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication If a server hosts hillaryclintonisgreat.com and donaldtrumpisgreat.com, then SNI leaks the domain and lets the ISP know definitively which one you visited.
- Dylan16807 10y agoAnd in practice there will almost never be other domains on the same certificate that can cloak your actions. SNI takes a bit of metadata that is basically public and makes it fully public. If you want to hide the domain you need to use another method.
- C4K3 10y agoHow exactly is one domain per IP better than SNI privacy wise? If you run one domain per IP, then it's just as obvious who you're connecting to.