4 ms·
SNI leaks the host name over HTTPS. Also, if the IP addresses are distinct enough they could be used to detect the destination as well.
by brewmarche 5y ago
SNI leaks the host name over HTTPS. Also, if the IP addresses are distinct enough they could be used to detect the destination as well.
- dtech 5y agoNote that isn't the case any more with modern browser + server, TLS 1.3 Encrypted Client Hello (ECH) fixes this.
- caskstrength 5y agoLast time I checked TLS Encrypted Client Hello standard was still under heavy development and implementation in Firefox was disabled by default. Is this not the case anymore?
- silon42 5y agoIMO, it's a bad design... SNI encryption should be done by firewall, not the client.
- dtech 5y agoMy mistake, it seems to still be a draft standard
- brewmarche 5y agoBoth this draft and eSNI unfortunately are not widely in use.