3 ms·

The hostname of most (all?) TLS connections is sent plaintext at the start of a new connection. This is called SNI (Server Name Indication). That provides some

by mox1 5y ago

The hostname of most (all?) TLS connections is sent plaintext at the start of a new connection. This is called SNI (Server Name Indication). That provides some (or a lot) of value I am guessing.

kstrauser 5y ago
Even without that, it's a pretty easy traffic analysis for: - Time T0: User requests the DNS record for example.com - Time T0+10ms: DNS returns "example.com. 193 IN A 10.1.2.3" - Time T0+20ms: User opens a connection to 10.1.2.3 port 443 Chances are pretty good they're looking at example.com, even if you can't examine a single packet.
- symlinkk 5y ago
  Still hides HTTP level metadata like the path, POST body, cookies, etc, no? All you’d have is the hostname
  - kstrauser 5y ago
    TLS hides all that already.
- gruez 5y ago
  DoH mitigates this by hiding all DNS queries.
astrange 5y ago
This is solved by ECH/ODoH but for full effect you have to trust the DNS server.