News for hackers. Stuff that matters.

A comment on Cloudflare, Mozilla, Fastly, and Apple Working on Encrypted SNI. Parent comment

Re:Cloudflare, Mozilla, Fastly, and Apple Working on Encrypt... by michaelt on Monday July 16, 2018 @04:45AM (#17539691) 

  Every corporation which does SNI scanning for web
  filtering will require every user to insert the
  company's CA cert in every client they use.
Just require your employees to route port 443 traffic through a proxy, making a CONNECT request.

It doesn't prevent domain fronting, of course, but neither did SNI scanning.

[ Parent | on HN ]
Re:Cloudflare, Mozilla, Fastly, and Apple Working on Encrypt... by peterwwillis on Monday July 16, 2018 @06:04AM (#17540009)
What would this accomplish? I assume the CONNECT string would simply be the IP:PORT of the destination, the same as with SNI hiding, so it doesn't seem like it would make a difference.
[ Parent | on HN ]
Re:Cloudflare, Mozilla, Fastly, and Apple Working on Encrypt... by michaelt on Monday July 16, 2018 @06:24AM (#17540116)
I suppose that's a good point; although today the CONNECT command uses a hostname, a browser could change to using IP:PORT if they were serious about keeping hostnames secret.
[ Parent | on HN ]