5 ms·

Modern TLS is enough to prevent others from eavesdropping everything except domain names when on public WiFi. Domain names are sent in clear text if your client

by zekica 4y ago

Modern TLS is enough to prevent others from eavesdropping everything except domain names when on public WiFi. Domain names are sent in clear text if your client supports SNI.

doubled112 4y ago
A trail of DNS names is more than enough to know what somebody is up to.
- uup 4y ago
  You could use DoH, which you should do anyway. No reason to leak DNS lookups to anyone.
  - madars 4y ago
    DoH alone is not enough due to https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication being sent in plain text. Some day ECH (formerly, eSNI) should help with that.
    - erinnh 4y ago
      I thought TLSv1.3 already encrypted the SNI?
      - uup 4y ago
        It does
        Varloom 4y ago
        ESNI is not implemented yet on any website. And there is no software support except beta versions of Chrome/Edge and you have to manually toggle flags in dev mode. All SNIs are passed as plain text to your ISP/VPN, even with DoH/TLS secure DNS enabled.
      - detaro 4y ago
        No. ESNI is an later-created extension to TLS 1.3
  - deleted 4y ago
    [deleted]
  - ranger_danger 4y ago
    you'll always be leaking it to whoever you are sending your query to.