3 ms·
Say (an encrypted) hello to a more private internet
- charleyablaze 3y agoPrevious discussion from Cloudflare's launch: https://news.ycombinator.com/item?id=37703885 https://news.ycombinator.com/item?id=37703885
- tjrgergw 3y agoELI5 please?
- charleyablaze 3y agoThis prevents governments, ISPs, etc from identifying which websites people are visiting and censoring their connections. Firefox are enabling it by default.
- tjrgergw 3y agoRight because even with HTTPS, it's possible to know the domain you're accessing, even though you can't tell high individual urls you are accessing. Interesting.
- taway1237 3y agoIt's - technically - a problem with TLS, not HTTPS. TLS requires the server to pick a key way before user sends first encrypted bytes (like a HTTP host header). It's not a problem when every HTTPS server has another IP, but that internet is gone. So if there are two domains with different TLS certificated hosted on a single IP:port, the webserver has to guess which key to use (usually one is the default). To fix this, SNI extension to TLS was introduced. Now TLS client will optionally send a plaintext domain name it tries to connect to, and the webserver picks a key for that domain. Which is nice but... now the client is leaking their domain name. Encrypted hello in TLS finally fixes this problem.
- morjom 3y agoNext up, more DNSSEC adoption?
- hulitu 3y ago"So the problem now is that there are too many ISPs selling user data, that's why in the future we only need one or two." Sincerely, the CIA
- dfindley 3y agoCan the ISP still see the IP address? And then can’t they reverse DNS lookup possible domain names?
- hulitu 3y agoNo. /s Even Mozilla's telemetry is encrypted, so private.