3 ms·
Getting rid of plaintext SNI won't help much. The domain is there in the certificate itself. There are, of course, some (or maybe many, I don't have statistics
by jakobdabo 9y ago
Getting rid of plaintext SNI won't help much.
The domain is there in the certificate itself. There are, of course, some (or maybe many, I don't have statistics) certificates for multiple domains (wildcard and alt. name), but still.
- cesarb 9y ago> The domain is there in the certificate itself. With TLS 1.3, the certificate is in the encrypted portion of the handshake.
- jakobdabo 9y agoThat's nice to hear. I stand corrected, thank you.
- dingaling 9y agoHowever as I understand the protocol the very first step of the TLS 1.3 handshake, the nonce generation, can be MiTMed sufficiently to allow an attacker to determine the target domain. It's only in the next step that server and client do authentication. The attacker can't trivially continue the handshake beyond that point but that might give enough info to log the attempt and terminate the connection.
- MertsA 9y agoOr just connect up a second connection and see what certificate they send back.