3 ms·

SSL does not really keep the domain name private at all either way though. That is no good solution to this, because your ISP needs to know how to route your re

SSL does not really keep the domain name private at all either way though. That is no good solution to this, because your ISP needs to know how to route your request, right? Or, am I misunderstanding your point?

danjoc 10y ago
>SSL does not really keep the domain name private at all either way though. Sure it does. That's the whole point of SNI. SSL encrypts the request, including the domain name. If you share a single IP address with multiple vhosts, you have two options. SNI, which leaks the domain in the clear, or a certificate matching all the domains you vhost. https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication If a server hosts hillaryclintonisgreat.com and donaldtrumpisgreat.com, then SNI leaks the domain and lets the ISP know definitively which one you visited.
- Dylan16807 10y ago
  And in practice there will almost never be other domains on the same certificate that can cloak your actions. SNI takes a bit of metadata that is basically public and makes it fully public. If you want to hide the domain you need to use another method.