4 ms·
Firefox has an about:config setting called: "security.ssl.disable_session_identifiers" This prevents the browser from using session identifiers and will renego
by anfilt 6y ago
Firefox has an about:config setting called: "security.ssl.disable_session_identifiers"
This prevents the browser from using session identifiers and will renegotiate a new key for every session.
- 1vuio0pswjnm7 6y agoBut there is no config to disable SNI, so Firefox send cleartext domainname in every ClientHello. Makes me think the session ID about:config is not really aimed at privacy concerns.
- anfilt 6y agoYou can toggle the "network.security.esni.enabled" setting in about config. However, turning off SNI will cause any server that is hosting multiple websites to just break. So you can't really just shut SNI off sadly.
- 1vuio0pswjnm7 6y agoMost sites I visit that are posted to HN do not require SNI. I have a whitelist of sites requiring SNI. It is only a fraction of the whitelist I have for all sites. SNI is off by default in the proxy configs I use. Works for me. AFAIK the only sites that offer ESNI are defo.ie and sites using Cloudflare. For ESNI, I have only used Stephen Farrell's ESNI-enabled OpenSSL, not Firefox.