3 ms·
It’s a step in the right direction. Also is TLS1.3. not supposed to encrypt SNI?
by QasimK 9y ago
It’s a step in the right direction. Also is TLS1.3. not supposed to encrypt SNI?
- slowsun 9y agoI agree that a non-Google public resolver, which comes with guarantees about how they'll use your data, is a good thing. I'm taking exception with Cloudflare's announcement, which makes a pitch to end users that CF can protect your domain history from ISP snooping, then links to a two-minute setup guide for people with "no technical skill". They really can't protect your domain history, and I feel bad for people using this service who have been led to believe otherwise. AFAIK there is nothing in the TLS 1.3 draft [1] about SNI encryption. There are other draft proposals for SNI encryption that build on top of TLS 1.3 [2]. It's a hard problem and there are no deployed solutions I'm aware of. [1] https://tools.ietf.org/html/draft-ietf-tls-tls13-28 https://tools.ietf.org/html/draft-ietf-tls-tls13-28 [2] https://tools.ietf.org/html/draft-ietf-tls-sni-encryption-00 https://tools.ietf.org/html/draft-ietf-tls-sni-encryption-00
- djsumdog 9y agoI thought this was one of the big contentious issues with TLS1.3, that got resolved in a recent spec approval?