2 ms·
Basically, I am against SNIs today's implementation, and want to allow people who disable it to visit my sites. SNI transmits the host unencrypted, that is a r
by kuschku 9y ago
Basically, I am against SNIs today's implementation, and want to allow people who disable it to visit my sites.
SNI transmits the host unencrypted, that is a real security issue.
- jsmthrowaway 9y agoIn what sense? An attacker can already see the endpoints of a TLS conversation, and worrying about hostname disclosure is security through obscurity; the client already divulged the destination hostname with a probably-cleartext DNS query, too. Not worth worrying about. SNI is fine. If hostname disclosure is a security threat, the system needs rearchitecture. Systems that hostname their customers (mycompany.example.com) should use wildcards for that scenario instead of SNI, among other reasons. That’s the only possible concern I can imagine.
- jakupovic 9y agoWildcard certs work only 1 level deep. If you introduce regions and stages or other dimensions you would need multiple wildcard certs to cover e.g. SVCa.teama.region.example.com Multi domain certs help but then you need to encode all the names ahead of time and if you miss a name you need to reissue and reapply the cert.
- icebraining 9y agoThanks for answering!
- captncraig 9y agoDo you own a huge block of IPs or something? We have a massive monster cert in order to support non sni on a single ip. I hate it.
- kuschku 9y agoThat wouldn't avoid the issue, actually — I need to put a dozen domains in the same IP space with one cert to get this security property. Otherwise an adversary could simply see what IPs you connect to and reverse DNS them.