4 ms·
SNI header from TLS handshake is unencrypted so service providers (and Government's packet inspection engines) absolutely do see what website you are visiting
by slt2021 3y ago
SNI header from TLS handshake is unencrypted so service providers (and Government's packet inspection engines) absolutely do see what website you are visiting
https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication
Server Name Indication payload is not encrypted, thus the hostname of the server the client tries to connect to is visible to a passive eavesdropper. This protocol weakness was exploited by security software for network filtering and monitoring[4][5][6] and governments to implement censorship.[7] Presently, there are multiple technologies attempting to hide Server Name Indication.
Also some countries may mandate users to install and trust government's CA certificate which is then used to MITM HTTPS traffic
https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_attack https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_a...
- acchow 3y agoBut the SNI hostname will only include everything left of the TLD. So that is the TLD, the domain name, and the subdomain. It excludes the rest of the URL. If you have installed a root cert to allow the government to MITM, then there isn't really anything you can do...
- slt2021 3y agoSNI is enough to classify traffic for enforcement purposes. dont forget that if certain SNI is detected, your ISP/government may try to force downgrade TLS or replace server-hello with their own cert - meaning you will need to install government certificate to browse certain websites and 99% of users will do that to get access