3 ms·
Not saying they are malicious actors, but easy answer would be any Public WiFi anywhere. They all intercept DNS, less than 1% intercept SNI. It is also public
by iscoelho 1y ago
Not saying they are malicious actors, but easy answer would be any Public WiFi anywhere. They all intercept DNS, less than 1% intercept SNI.
It is also public knowledge that certain ISPs (including Xfinity) sniff and log all DNS queries, even to other DNS servers. TLS SNI is less common, although it may be more widespread now, I haven't kept up with the times.
- growse 1y agoIsn't the vast majority of TLS connections using SNI today?
- iscoelho 1y agoYes TLS SNI is ubiquitous. I am referring specifically to TLS SNI metadata collection.
- 1vuio0pswjnm7 1y agoPopular web browsers send SNI by default regardless of whether it is actually needed. For example, HTTPS-enabled websites not hosted at a CDNs may have no need for SNI. But popular web browsers will send it anyway.
- immibis 1y agoCiting a situation where DNS interception is good for the user isn't the best way to defend it being bad.