News for hackers. Stuff that matters.

A comment on Improving DNS Privacy in Firefox. Parent comment

Re:Improving DNS Privacy in Firefox by tialaramex on Friday June 01, 2018 @08:21AM (#17204589)
SNI doesn't encrypt the hostname but in TLS 1.3 it does secure it against middleboxes. If a MitM tries to alter the SNI then the connection fails.

TLS 1.3 also encrypts the server certificate. So if you want to send bonus SNI but get back real certificates that's just a matter between client and server.

The use case for Encrypted SNI remains sketchy. If I am the secret police of some authoritarian nation, who would block diebartdie.example why wouldn't I instead block the IP addresses of servers offering diebartdie.example? Only because it causes collateral damage? But why do I care, teach them not to associate with my enemies.

[ Parent | on HN ]
Re:Improving DNS Privacy in Firefox by gnode on Friday June 01, 2018 @09:49AM (#17205255)
> Only because it causes collateral damage? But why do I care

Because the collateral damage may not be worth it. The website a handful of dissidents use may not be worth blocking everything running on Cloudflare for all your citizens, for instance.

[ Parent | on HN ]