News for hackers. Stuff that matters.

A comment on How to keep your ISP’s nose out of your browser history with encrypted DNS. Parent comment

Re:How to keep your ISP’s nose out of your browser history w... by hacknat on Sunday April 08, 2018 @08:19PM (#16789332)
> But that’s vulnerable to MITM

It is if that’s all you’re trusting, but you get to check the validity of the cert, so someone could MITM a TLS 1.3, but it wouldn’t do them much good as all they would get is a request for a certificate, then the normal TLS certification steps must proceed. Without the certificate private key the rest of the handshake would fail.

[ Parent | on HN ]
Re:How to keep your ISP’s nose out of your browser history w... by gruez on Sunday April 08, 2018 @09:17PM (#16789557)
sure, they're not going to MITM your http connection, but they will be able to MITM your certificate connection, which allows them to discover what site you visited, which is the same problem that SNI has.
[ Parent | on HN ]
Re:How to keep your ISP’s nose out of your browser history w... by saurik on Sunday April 08, 2018 @11:59PM (#16790236)
They can do this, but your browser would retroactively notice that it happened and go "holy shit that was bad, you should complain to someone about it". This does not solve for all threat models, but it does avoid the "snoopy ISP".
[ Parent | on HN ]