3 ms·

ELI5 please?

• charleyablaze 3y ago
  This prevents governments, ISPs, etc from identifying which websites people are visiting and censoring their connections. Firefox are enabling it by default.
  • tjrgergw 3y ago
    Right because even with HTTPS, it's possible to know the domain you're accessing, even though you can't tell high individual urls you are accessing. Interesting.
    • taway1237 3y ago
      It's - technically - a problem with TLS, not HTTPS. TLS requires the server to pick a key way before user sends first encrypted bytes (like a HTTP host header). It's not a problem when every HTTPS server has another IP, but that internet is gone. So if there are two domains with different TLS certificated hosted on a single IP:port, the webserver has to guess which key to use (usually one is the default). To fix this, SNI extension to TLS was introduced. Now TLS client will optionally send a plaintext domain name it tries to connect to, and the webserver picks a key for that domain. Which is nice but... now the client is leaking their domain name. Encrypted hello in TLS finally fixes this problem.