4 ms·
If you could remove the common name/url from the clear text portion of the packet, that would make filtering the web site more difficult. Some enterprise firewa
by dvno42 8y ago
If you could remove the common name/url from the clear text portion of the packet, that would make filtering the web site more difficult. Some enterprise firewalls/filters look at the CN to match against a ratings database in lieu of DPI-SSL/MITM. Ex: https://itzecurity.blogspot.com/2014/05/configuring-fortios-v50-webfiltering.html https://itzecurity.blogspot.com/2014/05/configuring-fortios-...
- yardstick 8y agoI suspect if encrypted SNI became popular, you would find them censored via one means or another. I imagine state operators have the resources to scan all domains, connect to them to identify their content and just blacklist their IPs (along with any innocent domains hosted on the same IP). I could also see state operators mandating the plaintext SNI (by dropping non-SNI TLS), and operating a transparent TLS proxy based on that SNI with their own DNS lookup (so you would have to provide a legit, resolvable hostname in the plaintext SNI).