5 ms·
Does this mean in SSL, the host name is not plain-text but in TLS it is? To me, it seems better to use a possible-to-crack SSL with hidden hostname vs. hard/im
by chime 13y ago
Does this mean in SSL, the host name is not plain-text but in TLS it is?
To me, it seems better to use a possible-to-crack SSL with hidden hostname vs. hard/impossible to crack TLS where anyone can see I'm trying to go to https://anonymous-upload.wikileaks.org https://anonymous-upload.wikileaks.org.
- lucian1900 13y agoThey can see that anyway if they intercept the traffic anyway, since the IP will be in all packets. Even better, the TCP connection will end up creating routing tables on all hops along the way.
- masomenos 13y agoUnless there are multiple secured domains hosted on that IP address, in which case knowing the domain would be extra information.
- richardwhiuk 13y agoYou can't have multiple secure domains on a single host which don't require the user to know a non-standard port without exposing the domain in plain text as part of SNI.
- RKearney 13y agoYou can if you have a certificate with multiple domain names in the SAN[0] field. [0] http://en.wikipedia.org/wiki/SubjectAltName http://en.wikipedia.org/wiki/SubjectAltName
- mrud 13y agoI don't get the comment how TCP creates routing tables but just having an IP address for HTTPS is not necessarily sufficient as you can have virtual hosts.
- cbr 13y agoIf the host name is encrypted the server needs to provide an SSL certificate identifying itself before it knows what host the user will request. This works if there's only one host on that IP, but if there's a 1-to-1 mapping between hosts and IPs then an attacker can figure out you're going to anonymous-upload.wikileaks.org from the fundamentally public information that you're going to 190.93.240.19. The way to fix this is to use tor, not to go back to old versions of SSL. https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication
- xnyhps 13y agoNote that certificates are always sent in plain. If it's a CA-signed certificate it will always have a common name or subject alt name field that specifies what host it is for (or a wildcard), readable in plain. If it's a self-signed certificate scrubbed from anything identifiable then a server could still try to correlate what website you visited by the public key from the certificate.
- billpg 13y agoAnyone monitoring you will have seen your initial DNS query.