UK ISP group names Mozilla 'Internet Villain' for supporting 'DNS-over-HTTPS'

Re:UK ISP group names Mozilla 'Internet Villain' for support... by tremon on Friday July 05, 2019 @10:40AM (#20362840)

But how does that tie in with SNI? The specs say that the client sends the intended hostname as part of the TLS handshake, can the ISP sniff the hostname from that handshake?

[edit] as per wikipedia, https://en.wikipedia.org/wiki/Server_Name_Indication:

The desired hostname is not encrypted, so an eavesdropper can see which site is being requested. This helps security companies provide a filtering feature and governments implement censorship. [..] As of mid 2018, an upgrade called Encrypted SNI (ESNI) is being rolled out in an "experimental phase" to address this risk of domain eavesdropping. On March 1, 2019, Daniel Stenberg stated that Mozilla Firefox supports ESNI.

[ Parent | on HN ]

Re:UK ISP group names Mozilla 'Internet Villain' for support... by arccy on Friday July 05, 2019 @10:41AM (#20362850)

Which is why encrypted SNI is in development

[ Parent | on HN ]

Re:UK ISP group names Mozilla 'Internet Villain' for support... by _o-O-o_ on Friday July 05, 2019 @11:09AM (#20363074)

Test for eSNI here: https://www.cloudflare.com/ssl/encrypted-sni/

[ Parent | on HN ]

Re:UK ISP group names Mozilla 'Internet Villain' for support... by rocqua on Friday July 05, 2019 @11:26AM (#20363246)

You can sniff SNI which will still reveal hostnames. In certain cases though, you can use 'domain fronting'. That is using a different Host in the HTTPS header than is included in SNI. If that other hostname is served by the same ip address and certificate, then that server might just forward your HTTPS message to the host requested in the HTTPS header.

[ Parent | on HN ]