3 ms·
This is an interesting detail from Ryan Sleevi > So I don't think this buys any improvement over the status quo, and actually makes it considerably more comple
by ploxiln 9y ago
This is an interesting detail from Ryan Sleevi
> So I don't think this buys any improvement over the status quo, and actually makes it considerably more complex and failure prone, due to the cross-sectional lookups, versus the fact that .invalid is a reserved TLD.
So it should be more likely for shared hosting services to recognize that .invalid is an explicitly reserved TLD, vs correctly walking subdomains and recognizing "effective TLDs" (which vary in number of dot-separated elements).
- mdhardeman 9y agoIndeed that the hosting providers do neither is a strong sign that both TLS-SNI-01 and TLS-SNI-02 and the mechanism I proposed would all be deficient to really address the issue of making this mechanism secure again.
- ploxiln 9y agoAgreed. It may be necessary to abandon TLS-SNI. Maybe ALPN will work out.