4 ms·

Wouldn't a VPN also prevent traffic sniffing if you're connected via a public wi-fi point?

by hnzix 4y ago

astrange 4y ago
It would, but that’s already generally impossible thanks to everything being on HTTPS (including DNS).
- _0w8t 4y ago
  HTTPS typically still have the site domain in clear due to SNI.
  - agileAlligator 4y ago
    > HTTPS typically still have the site domain in clear due to SNI. Can you eli5 that please?
    - astrange 4y ago
      https://www.cloudflare.com/learning/ssl/what-is-encrypted-sni/ https://www.cloudflare.com/learning/ssl/what-is-encrypted-sn...
    - _0w8t 4y ago
      To support multiple sites per IP the browser has to send DNS name of the site to the web server. Moreover, since certificates that the server uses for encryption depends on the site name, the name cannot be encrypted within HTTPS. So the browser sends the name in clear when initiating the connection. This is called SNI, server-name-identification. It is possible to encrypt SNI, but most sites do not support that as the setup is non-trivial and error-prone.
      - agileAlligator 4y ago
        Huh So HTTPS doesn't really stop tracking, it only prevents people from snooping on what data you are sending to and receiving from the website
        hnzix 4y ago
        I use CloudFlare's 1.1.1.1 DNS to mitigate my ISP tracking the domains I visit. They have an iPhone app too. I don't know enough about the space to say whether it's 100% effective.
        _0w8t 4y ago
        Again, due to SNI tracking sites that one visits is possible even if DNS traffic is encrypted. At the very least one needs for the site to support ESNI or encrypted-site-name-identification. But then in practice for ESNI to be effective one needs for the site to use CDN or similar solutions to ensure that there are a lot of sites for the given IP.
        rayhaanj 4y ago
        There has been some work on encrypted server name indication: https://www.cloudflare.com/learning/ssl/what-is-encrypted-sni/ https://www.cloudflare.com/learning/ssl/what-is-encrypted-sn...

Wouldn't a VPN also prevent traffic sniffing if you're connected via a public wi-fi point?

by hnzix 4y ago

Wouldn't a VPN also prevent traffic sniffing if you're connected via a public wi-fi point?

astrange 4y ago

It would, but that’s already generally impossible thanks to everything being on HTTPS (including DNS).

_0w8t 4y ago
HTTPS typically still have the site domain in clear due to SNI.
- agileAlligator 4y ago
  > HTTPS typically still have the site domain in clear due to SNI. Can you eli5 that please?
  - astrange 4y ago
    https://www.cloudflare.com/learning/ssl/what-is-encrypted-sni/ https://www.cloudflare.com/learning/ssl/what-is-encrypted-sn...
  - _0w8t 4y ago
    To support multiple sites per IP the browser has to send DNS name of the site to the web server. Moreover, since certificates that the server uses for encryption depends on the site name, the name cannot be encrypted within HTTPS. So the browser sends the name in clear when initiating the connection. This is called SNI, server-name-identification. It is possible to encrypt SNI, but most sites do not support that as the setup is non-trivial and error-prone.
    - agileAlligator 4y ago
      Huh So HTTPS doesn't really stop tracking, it only prevents people from snooping on what data you are sending to and receiving from the website
      - hnzix 4y ago
        I use CloudFlare's 1.1.1.1 DNS to mitigate my ISP tracking the domains I visit. They have an iPhone app too. I don't know enough about the space to say whether it's 100% effective.
        _0w8t 4y ago
        Again, due to SNI tracking sites that one visits is possible even if DNS traffic is encrypted. At the very least one needs for the site to support ESNI or encrypted-site-name-identification. But then in practice for ESNI to be effective one needs for the site to use CDN or similar solutions to ensure that there are a lot of sites for the given IP.
      - rayhaanj 4y ago
        There has been some work on encrypted server name indication: https://www.cloudflare.com/learning/ssl/what-is-encrypted-sni/ https://www.cloudflare.com/learning/ssl/what-is-encrypted-sn...