Cloudflare, Mozilla, Fastly, and Apple Working on Encrypted SNI

Re:Cloudflare, Mozilla, Fastly, and Apple Working on Encrypt... by namibj on Monday July 16, 2018 @05:38AM (#17539895)

No, the owner can sign the dns records and also sign the absence of a record, and if the censor tries to tell the browser that there is no SNI key, without being able to produce the signature to prove that, the browser can just treat this as an MITM attack. This only work on signed DNS entries though.

[ Parent | on HN ]

Re:Cloudflare, Mozilla, Fastly, and Apple Working on Encrypt... by icebraining on Monday July 16, 2018 @05:47AM (#17539933)

But they just want to block it, so if the browser and/or app treats it as a MITM attack, that's fine from the censor's POV.

[ Parent | on HN ]

Re:Cloudflare, Mozilla, Fastly, and Apple Working on Encrypt... by namibj on Monday July 16, 2018 @01:31PM (#17543094)

There is a difference between inciting end point devices to drop down to less secure protocols, and alerting the user that you are running an active attack.

[ Parent | on HN ]