5 ms·

The subsequent SSL requests still include the host in clear text, so while a move in the right direction, does little to stop request sniffing.

by donatj 6y ago

svenfaw 6y ago
No, they only include the DNS server name in cleartext. (Unless I’m misunderstanding DoH)
- donatj 6y ago
  The lookup is encrypted yes. Your actual subsequent request to the webserver you looked up the DNS entry for however exposes the host in clear text. This is how a lot of corporate firewalls sniff HTTPS requests for host without a root cert. https://security.stackexchange.com/questions/86723/why-do-https-requests-include-the-host-name-in-clear-text https://security.stackexchange.com/questions/86723/why-do-ht...
  - terinjokes 6y ago
    If you enable it in about:config, Firefox does support the Encrypted SNI proposal when used with DoH and providers that support it. It works for me on Firefox for Android. https://blog.cloudflare.com/encrypted-sni/ https://blog.cloudflare.com/encrypted-sni/ Disclaimer: I work for Cloudflare, but not on this project.
    - livre 6y ago
      ESNI is a great solution but unlike DoH it has yet to see wider adoption. I have it enabled and I have Firefox pointed to my local DoH server, the majority of the websites still reply with NXDOMAIN to the _esni query. Besides Cloudflare I've only found 1 other website that has it enabled.
aquadrop 6y ago
You still ultimately will be exposing server you're talking to by ip, right?
raxxorrax 6y ago
Exposing the host if often not that much of a problem in my opinion. I doubt if there are any solutions to obfuscate the host, since packages just need to be routed somewhere. At least it wouldn't be a DNS problem, since for IP the same restrictions apply.
kreetx 6y ago
Right now yes, but when Encrypted SNI is adopted then not anymore. It seems that when DoH and ESNI become the defaults there won't be much sniffing going on? (Apart from looking at the IPs of course.)
- deleted 6y ago
  [deleted]
- Avamander 6y ago
  Star or thumbs up these issues if you want ESNI to be prioritized more: https://bugs.chromium.org/p/chromium/issues/detail?id=908132 https://bugs.chromium.org/p/chromium/issues/detail?id=908132 https://github.com/openssl/openssl/issues/7482 https://github.com/openssl/openssl/issues/7482

The subsequent SSL requests still include the host in clear text, so while a move in the right direction, does little to stop request sniffing.

by donatj 6y ago

The subsequent SSL requests still include the host in clear text, so while a move in the right direction, does little to stop request sniffing.

svenfaw 6y ago

No, they only include the DNS server name in cleartext. (Unless I’m misunderstanding DoH)

donatj 6y ago
The lookup is encrypted yes. Your actual subsequent request to the webserver you looked up the DNS entry for however exposes the host in clear text. This is how a lot of corporate firewalls sniff HTTPS requests for host without a root cert. https://security.stackexchange.com/questions/86723/why-do-https-requests-include-the-host-name-in-clear-text https://security.stackexchange.com/questions/86723/why-do-ht...
- terinjokes 6y ago
  If you enable it in about:config, Firefox does support the Encrypted SNI proposal when used with DoH and providers that support it. It works for me on Firefox for Android. https://blog.cloudflare.com/encrypted-sni/ https://blog.cloudflare.com/encrypted-sni/ Disclaimer: I work for Cloudflare, but not on this project.
  - livre 6y ago
    ESNI is a great solution but unlike DoH it has yet to see wider adoption. I have it enabled and I have Firefox pointed to my local DoH server, the majority of the websites still reply with NXDOMAIN to the _esni query. Besides Cloudflare I've only found 1 other website that has it enabled.

aquadrop 6y ago

You still ultimately will be exposing server you're talking to by ip, right?

raxxorrax 6y ago

Exposing the host if often not that much of a problem in my opinion. I doubt if there are any solutions to obfuscate the host, since packages just need to be routed somewhere. At least it wouldn't be a DNS problem, since for IP the same restrictions apply.

kreetx 6y ago

Right now yes, but when Encrypted SNI is adopted then not anymore. It seems that when DoH and ESNI become the defaults there won't be much sniffing going on? (Apart from looking at the IPs of course.)

deleted 6y ago
[deleted]
Avamander 6y ago
Star or thumbs up these issues if you want ESNI to be prioritized more: https://bugs.chromium.org/p/chromium/issues/detail?id=908132 https://bugs.chromium.org/p/chromium/issues/detail?id=908132 https://github.com/openssl/openssl/issues/7482 https://github.com/openssl/openssl/issues/7482