4 ms·

According to the spec [0] it looks like SNI is not needed. It just specifies a TLS connection. Why does it send an SNI? I guess because basically everything doe

According to the spec [0] it looks like SNI is not needed. It just specifies a TLS connection. Why does it send an SNI? I guess because basically everything does it so why should Tor not send it? [0]: https://spec.torproject.org/tor-spec/negotiating-channels.html https://spec.torproject.org/tor-spec/negotiating-channels.ht...

1vuio0pswjnm7 3y ago
"... why should Tor not send it?" Why not send the string "Hi there! I'm using Tor." Why not. Tor is annoucing itself with a unique TLS fingerprint anyway. "Why not" was not the question I asked. IMO, it's a different question than asking "Why". SNI has been used for censorship. Perhaps this is why the servername is apparently dynamic rather than static. I do not know. There could be many answers to "Why not". We might not know all of them. I certainly will never know all of them. I am not arguing for or against sending SNI. I have had that debate too many times on HN. TLS1.3 encrypts the handshake and ECH encrypts SNI. The folks who did that work on TLS thought it was worth doing. What was their reason. Was it "Why not encrypt the handshake and the servername." Why encrypt DNS. Many people cite privacy as a reason. Yet HN commenters will routinely claim that they can determine (with no significant, additional effort) what sites someone is accessing because they can see the IP addresses on the wire. If so, then why try to make DNS private. Why encrypt DNS and at the same time send plaintext domainnames on the wire via SNI. A significant portion of the web is still using TSL1.2 so the DNS names in the certificate are sent plaintext in the handshake as well. Why not just use unencrypted DNS. Everyone else is doing it. No doubt Apple and others who have implemented "push notifications" thought "Why not" when they saw no need to be concerned about people sniffing the traffic. As a user, I'm not a fan of all the noise on the wire from Apple and so-called "tech" companies. I'm generally not interested in the "features" and "conveniences" they are pushing. (No pun intended.) Plugging in a computer with an OS from one of these so-called "tech" companies usually results in it immediately trying to connect to remote server(s) without any input from the computer owner. This is why I like NetBSD. Generally everything is off by default. It's up to me to decide what I want to automate.
- bauruine 3y ago
  Plain Tor says "Hi there! I'm connecting to a Tor node" because all relay IPs are public. You can't hide that fact with ECH or by not sending the SNI. Every second invested in that is just wasted.
  - 1vuio0pswjnm7 3y ago
    And of course I never suggested anyone could. Despite that I provided links to a couple of past discussions that show people are well-aware using "plain Tor" is not something anyone can hide, you keep trying to reframe the question I asked into something else, a debate whether using Tor is detectable or not. Who cares. Tell us something we do not already know. Why is Tor sending SNI. What is the purpose. It's a simple question. That is all I am asking. For example, CDNs use SNI to host many HTTPS-enabled sites on a limited number of IP addresses. Why is Tor using SNI.
    - bauruine 3y ago
      I've looked it up for you. "IIRC it just should look like normal TLS traffic." and "because basically everything does it" was correct. "/* Browsers use the TLS hostname extension, so we should too. */"
      - 1vuio0pswjnm7 3y ago
        Thanks. That's not much of a reason. These domain names are not fooling anyone. Just looking at them one can see they are faked up, not normal at all. Plus there is no corresponding DNS lookup. And not all traffic is browsers. Will have to edit this out and recompile tor daemon.

1vuio0pswjnm7 3y ago

"... why should Tor not send it?" Why not send the string "Hi there! I'm using Tor." Why not. Tor is annoucing itself with a unique TLS fingerprint anyway. "Why not" was not the question I asked. IMO, it's a different question than asking "Why". SNI has been used for censorship. Perhaps this is why the servername is apparently dynamic rather than static. I do not know. There could be many answers to "Why not". We might not know all of them. I certainly will never know all of them. I am not arguing for or against sending SNI. I have had that debate too many times on HN. TLS1.3 encrypts the handshake and ECH encrypts SNI. The folks who did that work on TLS thought it was worth doing. What was their reason. Was it "Why not encrypt the handshake and the servername." Why encrypt DNS. Many people cite privacy as a reason. Yet HN commenters will routinely claim that they can determine (with no significant, additional effort) what sites someone is accessing because they can see the IP addresses on the wire. If so, then why try to make DNS private. Why encrypt DNS and at the same time send plaintext domainnames on the wire via SNI. A significant portion of the web is still using TSL1.2 so the DNS names in the certificate are sent plaintext in the handshake as well. Why not just use unencrypted DNS. Everyone else is doing it. No doubt Apple and others who have implemented "push notifications" thought "Why not" when they saw no need to be concerned about people sniffing the traffic. As a user, I'm not a fan of all the noise on the wire from Apple and so-called "tech" companies. I'm generally not interested in the "features" and "conveniences" they are pushing. (No pun intended.) Plugging in a computer with an OS from one of these so-called "tech" companies usually results in it immediately trying to connect to remote server(s) without any input from the computer owner. This is why I like NetBSD. Generally everything is off by default. It's up to me to decide what I want to automate.

bauruine 3y ago
Plain Tor says "Hi there! I'm connecting to a Tor node" because all relay IPs are public. You can't hide that fact with ECH or by not sending the SNI. Every second invested in that is just wasted.
- 1vuio0pswjnm7 3y ago
  And of course I never suggested anyone could. Despite that I provided links to a couple of past discussions that show people are well-aware using "plain Tor" is not something anyone can hide, you keep trying to reframe the question I asked into something else, a debate whether using Tor is detectable or not. Who cares. Tell us something we do not already know. Why is Tor sending SNI. What is the purpose. It's a simple question. That is all I am asking. For example, CDNs use SNI to host many HTTPS-enabled sites on a limited number of IP addresses. Why is Tor using SNI.
  - bauruine 3y ago
    I've looked it up for you. "IIRC it just should look like normal TLS traffic." and "because basically everything does it" was correct. "/* Browsers use the TLS hostname extension, so we should too. */"
    - 1vuio0pswjnm7 3y ago
      Thanks. That's not much of a reason. These domain names are not fooling anyone. Just looking at them one can see they are faked up, not normal at all. Plus there is no corresponding DNS lookup. And not all traffic is browsers. Will have to edit this out and recompile tor daemon.