2 ms·
> even HTTPS leaks the requested URL It does not. In the olden days the host name was leaked, but with SNI even that is gone. Anything past the first "/" is ne
by dmitrygr 4y ago
> even HTTPS leaks the requested URL
It does not. In the olden days the host name was leaked, but with SNI even that is gone. Anything past the first "/" is never and was never sent in plaintext in HTTPS
- cperciva 4y agoMost public web sites leak information about page accesses to anyone who can count bytes.
- teaearlgraycold 4y agoWhat kind of attack are you describing?
- cperciva 4y agoCount how many bytes of TCP traffic you see. Measure the size of each web page on the (public static) website.
- fmajid 4y agoThe host name is still leaked, SNI is not encrypted and ESNI is still not mandatory in TLS 1.3.
- 2h 4y ago> host name was leaked, but with SNI even that is gone nope, you can still see it perfectly fine: https://tlshello.agwa.name/ https://tlshello.agwa.name/ please don't spread misinformation.