3 ms·

So the only solution is to increase the effort to decrypt. And for that we have to either/both increase complexity of the crypto (hard) and the amount of noise

by gcb0 13y ago

So the only solution is to increase the effort to decrypt. And for that we have to either/both increase complexity of the crypto (hard) and the amount of noise traffic. Changing the crypto would require lots of time to roll out new platforms and updated clients. Hence, the only feasible way to save the internet is to convert all porn sites to https. If you work on a ISP, block all porn connections over http, nature will find a way and the https sites will popup overnight.

icebraining 13y ago
With SNI[1], the hostname is sent unencrypted (so that you can host more than one domain in a single IP address), so the watchers can simply filter out porn domains. [1] https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication
- contingencies 13y ago
  As of November 2012, the only major user bases whose browsers do not support SNI appear to be users of Android 2.x (default browser), Internet Explorer (any version) on Windows XP and versions of Java before 1.7 on any operating system. Apparently we can thank the French: http://www.edelweb.fr/EdelKey/ http://www.edelweb.fr/EdelKey/
- X-Istence 13y ago
  It is sad, but by the time SNI is a viable extension to use, IPv6 should be in full swing and SNI will no longer be required :-(.
  - graue 13y ago
    SNI is already plenty viable if you have few/no IE users. That's certainly not everyone, but it's good enough for some of us.
    - bigiain 13y ago
      And while I know cPanel/WHM doesn't really belong in the same discussion as "encryption possibly resilient against state level attackers"… I note with interest that the latest cPanel update (11.38) includes SNI support. That's "switched on" an _huge_ userbase of webhosting that can now grab a cheap/free SSL cert without needing dedicated ip addresses, and who can then tell users "you'll need to upgrade your browser to use our secure site - have you tried downloading Chrome?" ;-)
- mappu 13y ago
  From a security point of view I don't think this changes anything - in the absence of SNI, you can get the hostname anyway just by starting a TLS connection to the server, as your browser would. (Unless porn sites start whitelisting incoming IP addresses, which seems pretty unlikely)
sliverstorm 13y ago
Changing the crypto would require lots of time to roll out new platforms and updated clients. Which is just an argument for starting sooner rather than later, and staying ahead of the curve, rather than giving up the point...
- gcb0 13y ago
  couldn't agree more. was just setting the joke up. :)
fixxer 13y ago
"nature will find a way" brilliant statement. thank you.
7952 13y ago
Or protocols need to develop that use out of band communication to seed certificates. Just mail me some entropy :)

by gcb0 13y ago

icebraining 13y ago

With SNI[1], the hostname is sent unencrypted (so that you can host more than one domain in a single IP address), so the watchers can simply filter out porn domains. [1] https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication

contingencies 13y ago
As of November 2012, the only major user bases whose browsers do not support SNI appear to be users of Android 2.x (default browser), Internet Explorer (any version) on Windows XP and versions of Java before 1.7 on any operating system. Apparently we can thank the French: http://www.edelweb.fr/EdelKey/ http://www.edelweb.fr/EdelKey/
X-Istence 13y ago
It is sad, but by the time SNI is a viable extension to use, IPv6 should be in full swing and SNI will no longer be required :-(.
- graue 13y ago
  SNI is already plenty viable if you have few/no IE users. That's certainly not everyone, but it's good enough for some of us.
  - bigiain 13y ago
    And while I know cPanel/WHM doesn't really belong in the same discussion as "encryption possibly resilient against state level attackers"… I note with interest that the latest cPanel update (11.38) includes SNI support. That's "switched on" an _huge_ userbase of webhosting that can now grab a cheap/free SSL cert without needing dedicated ip addresses, and who can then tell users "you'll need to upgrade your browser to use our secure site - have you tried downloading Chrome?" ;-)
mappu 13y ago
From a security point of view I don't think this changes anything - in the absence of SNI, you can get the hostname anyway just by starting a TLS connection to the server, as your browser would. (Unless porn sites start whitelisting incoming IP addresses, which seems pretty unlikely)

sliverstorm 13y ago

Changing the crypto would require lots of time to roll out new platforms and updated clients. Which is just an argument for starting sooner rather than later, and staying ahead of the curve, rather than giving up the point...

gcb0 13y ago
couldn't agree more. was just setting the joke up. :)

fixxer 13y ago

"nature will find a way" brilliant statement. thank you.

7952 13y ago

Or protocols need to develop that use out of band communication to seed certificates. Just mail me some entropy :)