4 ms·
They aren't going to see behind the TLS curtain, but they would see (assuming no DNS encryption) a domain name lookup followed by various traffic patterns; eith
by hunter2_ 3y ago
They aren't going to see behind the TLS curtain, but they would see (assuming no DNS encryption) a domain name lookup followed by various traffic patterns; either:
Bursts (page loads) with near silence in between, maybe just some non-human-triggered traffic from scripts that poll.
Bursts (page loads) with quite a bit more of a human-triggered cadence in between, if lazy loading during scrolling occurs.
But mouse-tracking analytics probably result in a similar leak, if not better.
- lxgr 3y agoEven with encrypted DNS, the unencrypted host name is usually part of the TLS handshake (or the server wouldn’t know what certificate to present to you).
- rcme 3y agoBut you also usually keep the connection alive for multiple requests.
- lxgr 3y agoTo the same host though, so that doesn’t really help with privacy, no?
- hunter2_ 3y agoTrue, though there seems to be decent momentum toward ECH (which supplants ESNI) lately: https://blog.cloudflare.com/handshake-encryption-endgame-an-ech-update/ https://blog.cloudflare.com/handshake-encryption-endgame-an-... https://www.reddit.com/r/CloudFlare/comments/wp6yve/what_are_some_encrypted_client_hello_ech_esni/ https://www.reddit.com/r/CloudFlare/comments/wp6yve/what_are...
- leptons 3y agoI don't care. At some point the law of diminishing returns makes some bit of exfiltration of user interaction pointless to worry about.