3 ms·
Encrypted SNI is a solution in search of a problem. Unencryptable metadata (destination IP) makes it pretty worthless. Even on shared services like Cloudflare,
by mike_d 6y ago
Encrypted SNI is a solution in search of a problem.
Unencryptable metadata (destination IP) makes it pretty worthless. Even on shared services like Cloudflare, things that are of interest for collection are probably paying enough that they get stuck on dedicated IPs. The 4chans of the world that might not be paying still make sense from a provider perspective to move to isolated IPs for DDoS mitigation.
Censoring proxies actually look at SNI to deconflict shared IPs where pornsite.com and travelblog.com are on the same Cloudflare IP, and will just revert to blocking the destination by default.
(I'm picking on Cloudflare here specifically because they are pushing it - but this applies to MaxCDN, Akamai, etc just as much)
- nybble41 6y ago> and will just revert to blocking the destination by default Good. That's way better than being able to tell which site you were trying to go to. It's more expensive for the misbehaving network operators as well; block some popular sites just because they share an IP address with something you want to censor and people are bound to complain, even if they couldn't care less about the censored sites.
- prdonahue 6y agoAnd what happens when the IP address returned by Cloudflare is a random draw from one of several million addresses?