4 ms·
No, the owner can sign the dns records and also sign the absence of a record, and if the censor tries to tell the browser that there is no SNI key, without bein
by namibj 8y ago
No, the owner can sign the dns records and also sign the absence of a record, and if the censor tries to tell the browser that there is no SNI key, without being able to produce the signature to prove that, the browser can just treat this as an MITM attack. This only work on signed DNS entries though.
- icebraining 8y agoBut they just want to block it, so if the browser and/or app treats it as a MITM attack, that's fine from the censor's POV.
- namibj 8y agoThere is a difference between inciting end point devices to drop down to less secure protocols, and alerting the user that you are running an active attack.