6 ms·

> the FQDN is sent plaintext as part of HTTPS. Can you please elaborate on that? domain name is sent after ssl handshake, no? Why is it sent plaintext?

kohtatsu 7y ago
Back in the day there was mostly only 1 website per IP, so when you connected over port 443 for HTTPS, the server would only have the one cert to give you. One day people wanted to serve multiple websites from one IP, so they had browsers tell the server which site they are looking for (Server Name Indication); that way the server would know which SSL cert to send for the handshake. SNI is still plaintext, it's a glaring privacy hole that most people aren't aware of. Encrypted SNI needs to come sooner.
- zzzcpan 7y ago
  Nope, encrypted SNI cannot work against GFW or pretty much any state censorship as the whole idea is bullshit and relies on everyone a) tunneling DNS queries to a centralized party, which itself only operates under the state's mercy, and b) everyone hosting on a single centralized party and c) this party randomizing IP addresses of web sites (none of the CDNs do that, because they want to avoid risking all of their IP ranges being banned by states because of a single website).
  - kohtatsu 7y ago
    Oh gosh that sounds awful. I have to admit I was using "Encrypted SNI" in a general sense, I hadn't looked at the details of ESNI, the proposed solution. In my head encrypted SNIs was a somewhat straightforward problem to solve but thinking about it more it's a bit tricky. What you describe of ESNI sounds horribly convoluted :(
    - toast0 7y ago
      The key exchange and identification for encrypted X is always the hard part. For encrypted SNI, keys are expected to be published via DNS, which GFW is happy to disrupt. Once you get a key, you have to send the key identifier in the clear (otherwise, the service doesn't know how to decrypt; unless you want to just do trial decryption with all available keys and hope that doesn't use too much CPU); the key identifier becomes the enforcement target at this point, unless you're on a host that shares ESNI keys among the many sites it hosts and is not acceptable collateral damage.
swiley 7y ago
He’s probably talking about the DNS lookup.
- amdavidson 7y ago
  He is probably not. See your sibling comments.
callahad 7y ago
No. It's part of the cleartext SNI header. There is a proposal to encrypt the SNI information, but afaik, it's not yet widely used. https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication
- geocar 7y ago
  If I can assume Bob has Alice's public key (and that DNS was gold and whatever; i.e. the same axiom ESNI has), then: - DNS lookup for _esni.domain CNAME _esni.cloudflare.net, - client connect to _esni.cloudflare.net via HTTPS and negotiate TLS with SNI rejected - HTTP Host header contains desired target Servers can trivially support the above "new" protocol (chances are they already do), no changes to DNS clients libraries or servers, and clients can support the new "encrypted SNI" by using OpenSSL APIs that already exist. GFW can't do anything unless cloudflare give them the key for _esni.cloudflare.net. Everyone wins except the nerds who really wanted to make a new protocol. Oh and they need to walk back this stupid shit: https://support.cloudflare.com/hc/en-us/articles/360029779472#error1013 https://support.cloudflare.com/hc/en-us/articles/36002977947...
  - zzzcpan 7y ago
    > Oh and they need to walk back this stupid shit And the reason this stupid shit of preventing domain fronting was put in place is the exact reason why eSNI doesn't work, i.e. because it prevents state censorship and forces the state to instead block all the IP addresses in turn forcing companies to either cooperate with the state or expose enough identifying info to not interfere with state censorship.
nneonneo 7y ago
A given server might be hosting multiple websites, each with a different certificate (e.g. a CDN endpoint). It needs to know which certificate to present to the user. Therefore, during the initial TLS handshake, the client sends the server name (hostname) in plaintext in a field called the Server Name Indication (SNI). This is mandated by the fact that a certificate identifies a website, not a server. This is distinct from the HTTP Host: header, which is sent inside the TLS session and therefore is encrypted along with the rest of the HTTP request.
- GoblinSlayer 7y ago
  SNI is an optional extension and is legal to be missing. No SNI - no problem.
  - lxgr 7y ago
    You won't be able to reach any web server that is sharing more than one hostname per IP that way. This includes all sites on a free Cloudflare plan to my knowledge.
    - GoblinSlayer 7y ago
      Cloudflare terminates ssl at the edge, no? Then it has the private key and has no need to care about the site certificate. It just sends a certificate with all hosts in alt names.
      - lxgr 7y ago
        Cloudflare has way more customers/hostnames than what would fit into a single X.509 certificate. (They actually do seem to do what you describe to support non-SNI clients, but not on their free tier.) SNI also allows decoupling TLS and TCP termination, which in turn allows for shared IP addresses and load balancers without necessarily delegating TLS termination and exposing certificates to some shared host.
  - toast0 7y ago
stedaniels 7y ago
No. Cloudflare can explain it much better than me. https://www.cloudflare.com/learning/ssl/what-is-sni/ https://www.cloudflare.com/learning/ssl/what-is-sni/

kohtatsu 7y ago

Back in the day there was mostly only 1 website per IP, so when you connected over port 443 for HTTPS, the server would only have the one cert to give you. One day people wanted to serve multiple websites from one IP, so they had browsers tell the server which site they are looking for (Server Name Indication); that way the server would know which SSL cert to send for the handshake. SNI is still plaintext, it's a glaring privacy hole that most people aren't aware of. Encrypted SNI needs to come sooner.

zzzcpan 7y ago
Nope, encrypted SNI cannot work against GFW or pretty much any state censorship as the whole idea is bullshit and relies on everyone a) tunneling DNS queries to a centralized party, which itself only operates under the state's mercy, and b) everyone hosting on a single centralized party and c) this party randomizing IP addresses of web sites (none of the CDNs do that, because they want to avoid risking all of their IP ranges being banned by states because of a single website).
- kohtatsu 7y ago
  Oh gosh that sounds awful. I have to admit I was using "Encrypted SNI" in a general sense, I hadn't looked at the details of ESNI, the proposed solution. In my head encrypted SNIs was a somewhat straightforward problem to solve but thinking about it more it's a bit tricky. What you describe of ESNI sounds horribly convoluted :(
  - toast0 7y ago
    The key exchange and identification for encrypted X is always the hard part. For encrypted SNI, keys are expected to be published via DNS, which GFW is happy to disrupt. Once you get a key, you have to send the key identifier in the clear (otherwise, the service doesn't know how to decrypt; unless you want to just do trial decryption with all available keys and hope that doesn't use too much CPU); the key identifier becomes the enforcement target at this point, unless you're on a host that shares ESNI keys among the many sites it hosts and is not acceptable collateral damage.

swiley 7y ago

He’s probably talking about the DNS lookup.

amdavidson 7y ago
He is probably not. See your sibling comments.

callahad 7y ago

No. It's part of the cleartext SNI header. There is a proposal to encrypt the SNI information, but afaik, it's not yet widely used. https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication

geocar 7y ago
If I can assume Bob has Alice's public key (and that DNS was gold and whatever; i.e. the same axiom ESNI has), then: - DNS lookup for _esni.domain CNAME _esni.cloudflare.net, - client connect to _esni.cloudflare.net via HTTPS and negotiate TLS with SNI rejected - HTTP Host header contains desired target Servers can trivially support the above "new" protocol (chances are they already do), no changes to DNS clients libraries or servers, and clients can support the new "encrypted SNI" by using OpenSSL APIs that already exist. GFW can't do anything unless cloudflare give them the key for _esni.cloudflare.net. Everyone wins except the nerds who really wanted to make a new protocol. Oh and they need to walk back this stupid shit: https://support.cloudflare.com/hc/en-us/articles/360029779472#error1013 https://support.cloudflare.com/hc/en-us/articles/36002977947...
- zzzcpan 7y ago
  > Oh and they need to walk back this stupid shit And the reason this stupid shit of preventing domain fronting was put in place is the exact reason why eSNI doesn't work, i.e. because it prevents state censorship and forces the state to instead block all the IP addresses in turn forcing companies to either cooperate with the state or expose enough identifying info to not interfere with state censorship.

nneonneo 7y ago

A given server might be hosting multiple websites, each with a different certificate (e.g. a CDN endpoint). It needs to know which certificate to present to the user. Therefore, during the initial TLS handshake, the client sends the server name (hostname) in plaintext in a field called the Server Name Indication (SNI). This is mandated by the fact that a certificate identifies a website, not a server. This is distinct from the HTTP Host: header, which is sent inside the TLS session and therefore is encrypted along with the rest of the HTTP request.

GoblinSlayer 7y ago
SNI is an optional extension and is legal to be missing. No SNI - no problem.
- lxgr 7y ago
  You won't be able to reach any web server that is sharing more than one hostname per IP that way. This includes all sites on a free Cloudflare plan to my knowledge.
  - GoblinSlayer 7y ago
    Cloudflare terminates ssl at the edge, no? Then it has the private key and has no need to care about the site certificate. It just sends a certificate with all hosts in alt names.
    - lxgr 7y ago
      Cloudflare has way more customers/hostnames than what would fit into a single X.509 certificate. (They actually do seem to do what you describe to support non-SNI clients, but not on their free tier.) SNI also allows decoupling TLS and TCP termination, which in turn allows for shared IP addresses and load balancers without necessarily delegating TLS termination and exposing certificates to some shared host.
- toast0 7y ago

stedaniels 7y ago

No. Cloudflare can explain it much better than me. https://www.cloudflare.com/learning/ssl/what-is-sni/ https://www.cloudflare.com/learning/ssl/what-is-sni/