3 ms·
It's very nice that it doesn't do TLS termination, but it seems to rely on SNI. That's cool, but it probably precludes SNI encryption in the future. Is there a
by jchw 4y ago
It's very nice that it doesn't do TLS termination, but it seems to rely on SNI. That's cool, but it probably precludes SNI encryption in the future. Is there a plan around this? Maybe in the IPv6 world, it becomes a non-issue... But I wonder what comes first: the push for ESNI everywhere, or actually substantial IPv6 adoption.
(Edit; though come to think of it, in practice, if the IP address each host resolved to was unique, it wouldn't really matter very much from a security/privacy standpoint, so I guess it's probably not important...)
- bradfitz 4y agoAuthor here. This shouldn't preclude doing us Encrypted ClientHello in the future. We control the DNS for *.ts.net so we can publish our public key for browsers/etc to encrypt the ClientHello to, if I'm remembering the latest encrypted SNI spec(s)?
- jchw 4y agoAhh, yeah; disregard me, totally can. Cool!