4 ms·
Wouldn't it be possible to engineer the protocol in such a way that the domain that you want to go to is not publicly identifiable? Something like this, perhap
by oakwhiz 12y ago
Wouldn't it be possible to engineer the protocol in such a way that the domain that you want to go to is not publicly identifiable?
Something like this, perhaps?
1. Server sends a salt
2. Client sends hash of salt + target domain
3. Server computes hash of salt + target domain for all possible domains that it serves and compares to find out which one the client is requesting
- dsymonds 12y agoYou could do that, but who is going to want an extra round trip or two while making an HTTPS connection? Internet latency is often bad enough already.
- icebraining 12y agoUsing DNS, you can usually find all the domains a certain IP hosts[1], so the attacker could just do the same as the server to find the target domain. That said, there's an argument going at the IETF list about encrypting SNI and the rest of the TLS handshake: http://www.ietf.org/mail-archive/web/tls/current/msg11823.html http://www.ietf.org/mail-archive/web/tls/current/msg11823.ht... [1] http://reverseip.domaintools.com/ http://reverseip.domaintools.com/