3 ms·

One privacy feature I’d really like is kind of like HTTPS everywhere, except it’s TLS 1.3 w/ SNI encryption everywhere.

by kotlin2 4y ago

eli 4y ago
What would happen when you click a link to a site that doesn't support that?
- kotlin2 4y ago
  You’d get a warning and be asked to proceed. Similar to how https everywhere works.
mehlmao 4y ago
Firefox does offer an HTTPS only-mode, which tries to upgrade HTTP to HTTPS and warns you before connecting if it's not enabled. Settings > Privacy & Security > HTTPS-Only Mode As far as I know, there are still no practical attacks against TLS 1.2.
- kotlin2 4y ago
  The issue I’d like to solve is that, even with TLS, you still leak the SNI as part of the handshake. So your ISP can tell you’re connecting to google.com even if you’re using HTTPS.
  - emptyparadise 4y ago
    Wouldn't the ISP still know that you're connecting to Google, however?
    - kotlin2 4y ago
      Your ISP would know the IP address, but not specifically that you were connecting to google.com.
      - grangerg 4y ago
        Even without rDNS, they're almost certain to know of at least one DNS name that goes with the IP address you're connecting to. Even if not, they can label/categorize/group it by ISP and/or approximate location.
bobmaxup 4y ago
https://support.mozilla.org/en-US/kb/https-only-prefs/ https://support.mozilla.org/en-US/kb/https-only-prefs/ https://support.mozilla.org/en-US/questions/1101896 https://support.mozilla.org/en-US/questions/1101896
btdmaster 4y ago
Does anything support Encrypted Client Hello given its draft status? I got it back as unsupported when testing (yes, I would prefer to test on something other than Cloudflare but I couldn't find any): https://www.cloudflare.com/ssl/encrypted-sni/ https://www.cloudflare.com/ssl/encrypted-sni/
- kotlin2 4y ago
  I guess ESNI was deprecated and removed from Firefox in favor of ECH (just found that out now). CloudFlare supports ESNI, but not ECH. So that feels like a step backwards.

One privacy feature I’d really like is kind of like HTTPS everywhere, except it’s TLS 1.3 w/ SNI encryption everywhere.

eli 4y ago

What would happen when you click a link to a site that doesn't support that?

kotlin2 4y ago
You’d get a warning and be asked to proceed. Similar to how https everywhere works.

mehlmao 4y ago

Firefox does offer an HTTPS only-mode, which tries to upgrade HTTP to HTTPS and warns you before connecting if it's not enabled. Settings > Privacy & Security > HTTPS-Only Mode As far as I know, there are still no practical attacks against TLS 1.2.

kotlin2 4y ago
The issue I’d like to solve is that, even with TLS, you still leak the SNI as part of the handshake. So your ISP can tell you’re connecting to google.com even if you’re using HTTPS.
- emptyparadise 4y ago
  Wouldn't the ISP still know that you're connecting to Google, however?
  - kotlin2 4y ago
    Your ISP would know the IP address, but not specifically that you were connecting to google.com.
    - grangerg 4y ago
      Even without rDNS, they're almost certain to know of at least one DNS name that goes with the IP address you're connecting to. Even if not, they can label/categorize/group it by ISP and/or approximate location.

bobmaxup 4y ago

https://support.mozilla.org/en-US/kb/https-only-prefs/ https://support.mozilla.org/en-US/kb/https-only-prefs/ https://support.mozilla.org/en-US/questions/1101896 https://support.mozilla.org/en-US/questions/1101896

btdmaster 4y ago

Does anything support Encrypted Client Hello given its draft status? I got it back as unsupported when testing (yes, I would prefer to test on something other than Cloudflare but I couldn't find any): https://www.cloudflare.com/ssl/encrypted-sni/ https://www.cloudflare.com/ssl/encrypted-sni/

kotlin2 4y ago
I guess ESNI was deprecated and removed from Firefox in favor of ECH (just found that out now). CloudFlare supports ESNI, but not ECH. So that feels like a step backwards.