4 ms·
There's still SNI in TLS. Hopefully that changes in 1.3, but I don't know how prevalent that is yet.
by lallysingh 9y ago
There's still SNI in TLS. Hopefully that changes in 1.3, but I don't know how prevalent that is yet.
- dancek 9y agoWell, you can use a browser that doesn't support SNI (IE8) or one that makes it configurable (I don't know if any do). But a large amount of sites won't work without it. It's very common to run multiple sites on same ip/port. Not sure if it's technically possible to make that work without SNI or a similar technology.
- dancek 9y agoOn re-reading the grandparent I have to admit I missed the point. Considering CloudFlare offers to do SSL on their end, it'd be technically viable to only tell CF which domain you want.
- exikyut 9y agoWait. Wait a minute. I was planning literally this month to figure out how to implement domain traffic analytics on my LAN by using SNI via libpcap or similar (something tiny). Will I have to configure a root cert and build a full DPI proxy to make this futureproof? >_<
- lallysingh 9y agoIt'll be coming, and yes you will. On the bright side, nobody else without a root cert on your box can do it.
- exikyut 9y agoArgh. But thanks for the honest headsup. Time to go learn how to do DPI...
- paulryanrogers 9y agoEven without SNI the ISP could just check the destination IP themselves to find out what domain resides there.
- SXX 9y agoConsidering almost all websites except for largest one are behind one CDN / load balancer or another this is no longer relevant.