2 ms·
How do you handle regular old HTTPS?
by comex 8y ago
How do you handle regular old HTTPS?
- discreditable 8y agoThe filter looks at the SNI header during the TLS handshake. If it doesn't like the host it will reset the connection.
- cesarb 8y agoDoes this mean you block all of Wikipedia? And what will you do once encrypted SNI becomes popular?
- discreditable 8y agoI don't block Wikipedia. I looked at some wire traffic and I can see the SNI header as normal in Firefox 67 and Chrome 72. I found a about:config flag to enable esni, toggled it, restarted the browser, and I still see the SNI. Using Cloudflare's ESNI checker it says my browser isn't using it. Ignoring ESNI will probably work fine for a good length of time. If pornhub implements it or something I'd probably have to revisit. Or, since I control the clients I might disable it in their browsers. If enough people bark up the filter vendor's tree I'm sure they'll add a checkbox to drop esni traffic. They added one for QUIC recently.