Rand Paul: NSA Routinely Monitors Americans’ Communications Without Warrants

Re:Rand Paul: NSA Routinely Monitors Americans’ Communicatio... by willstrafach on Monday March 13, 2017 @04:20PM (#13861956)

SSL does not really keep the domain name private at all either way though. That is no good solution to this, because your ISP needs to know how to route your request, right? Or, am I misunderstanding your point?

[ Parent | on HN ]

Re:Rand Paul: NSA Routinely Monitors Americans’ Communicatio... by danjoc on Monday March 13, 2017 @08:03PM (#13863767)

>SSL does not really keep the domain name private at all either way though.

Sure it does. That's the whole point of SNI. SSL encrypts the request, including the domain name. If you share a single IP address with multiple vhosts, you have two options. SNI, which leaks the domain in the clear, or a certificate matching all the domains you vhost.

https://en.wikipedia.org/wiki/Server_Name_Indication

If a server hosts hillaryclintonisgreat.com and donaldtrumpisgreat.com, then SNI leaks the domain and lets the ISP know definitively which one you visited.

[ Parent | on HN ]

Re:Rand Paul: NSA Routinely Monitors Americans’ Communicatio... by Dylan16807 on Tuesday March 14, 2017 @02:53AM (#13865579)

And in practice there will almost never be other domains on the same certificate that can cloak your actions. SNI takes a bit of metadata that is basically public and makes it fully public. If you want to hide the domain you need to use another method.

[ Parent | on HN ]