3 ms·

Does anyone know Google's position on this? I tried finding a relevant Chromium issue but failed.

jgunsch 8y ago
The linked Twitter thread mentions that BoringSSL (maintained by Google, used in Chromium) has an implementation already.
- breakingcups 8y ago
  Right, I forgot BoringSSL was used in Chromium. Thanks!
tialaramex 8y ago
"Google's position" includes a lot more than just some Chromium developers, and even Chrome is big enough for there to be internal tension between teams focused on end-user security (e.g. encrypting SNI) and real world performance. Google is a cloud operator these days, and as such if something like this is to be of much use they'll have to eat the consequences at the other end, which means their product (Cloud servers) working less well for uncontroversial services than it might if they let censors do as they please. Basically for a cloud operator or CDN choosing to actually implement a working encrypted SNI solution (whatever it is) means now all your uncontroversial sites are obliged to tell censors "I'm Spartacus" and reap the consequences. If the censor is a single place of business or a micro-state maybe you can just suck it up. If it's Russia then you've just decided you want to annoy all your paying customers on a point of principle. I believe the word for that in Yes, Minister was "Brave". Ultimately, for this to be deliver much value (and if it doesn't why bother at all?) it needs to be something every major cloud provider and CDN does for all the sites they host. Which means from somewhere they're all going to need to find a lot more backbone than is needed for, say, TLS 1.3 itself. I hope it works, but I fear it will not.
- matt4077 8y ago
  Google and AWS are each large enough to make blocking them a very expensive proposition. I also get the sense that Google is pretty good at prioritizing long-term goals such as a fast and secure internet over any short-term considerations.

The linked Twitter thread mentions that BoringSSL (maintained by Google, used in Chromium) has an implementation already.

breakingcups 8y ago
Right, I forgot BoringSSL was used in Chromium. Thanks!

tialaramex 8y ago

"Google's position" includes a lot more than just some Chromium developers, and even Chrome is big enough for there to be internal tension between teams focused on end-user security (e.g. encrypting SNI) and real world performance. Google is a cloud operator these days, and as such if something like this is to be of much use they'll have to eat the consequences at the other end, which means their product (Cloud servers) working less well for uncontroversial services than it might if they let censors do as they please. Basically for a cloud operator or CDN choosing to actually implement a working encrypted SNI solution (whatever it is) means now all your uncontroversial sites are obliged to tell censors "I'm Spartacus" and reap the consequences. If the censor is a single place of business or a micro-state maybe you can just suck it up. If it's Russia then you've just decided you want to annoy all your paying customers on a point of principle. I believe the word for that in Yes, Minister was "Brave". Ultimately, for this to be deliver much value (and if it doesn't why bother at all?) it needs to be something every major cloud provider and CDN does for all the sites they host. Which means from somewhere they're all going to need to find a lot more backbone than is needed for, say, TLS 1.3 itself. I hope it works, but I fear it will not.

matt4077 8y ago
Google and AWS are each large enough to make blocking them a very expensive proposition. I also get the sense that Google is pretty good at prioritizing long-term goals such as a fast and secure internet over any short-term considerations.