4 ms·
New versions of encryption suites don't remove core functionality. This is like TLS removing SNI because it leaks information. It does, but the solution is ESNI
by franga2000 2mo ago
New versions of encryption suites don't remove core functionality. This is like TLS removing SNI because it leaks information. It does, but the solution is ESNI, not removing SNI all together.
It's not "please stop looking at network requests", it's "ask the user for informed consent to look at network requests". Make it a big scary red warning if you want to. Definitely don't auto-grant it to existing extensions.
There are many options that don't involve removing functionality. It's like when Google removed SMS and clipboard permissions because they used to be too broad. People were pissed, a bunch of apps were killed, Google's walled garden got reinforced...
- jimmydorry 1mo agoYou're being naieve if you don't think SNI will be fully deprecated in the future when a standard is settled on and reaches wide-adoption. Scare prompt fatigue is real. If you're constantly blasting users with "XXX wants to do Y" which sounds scary, you're training them to just accept without thinking.
- franga2000 1mo agoWell yes, SNI will be removed, when ESNI reaches far enough adoption. That's my point! ESNI does what SNI does, but securely. You fix an insecure implementation by replacing it with a secure implementation, not removing the feature completely.