News for hackers. Stuff that matters.

A comment on British ISP Lobbyists Backtrack on Calling Mozilla a Villain for DNS-over-HTTPS.

Re:British ISP Lobbyists Backtrack on Calling Mozilla a Vill... by lgats on Wednesday July 10, 2019 @01:11PM (#20403994)
> For example, if you configure your system to use Cloudflare's DoH service and visit a Cloudflare-hosted site over HTTPS, such as El Reg, your ISP will only see outbound connections to Cloudflare and have no idea what exactly you're leafing through: in this case, The Reg.

Doesn't the "HOST" field of the HTTPS negotiation give this data away to the ISP anyways?

[ Parent | on HN ]
Re:British ISP Lobbyists Backtrack on Calling Mozilla a Vill... by codedokode on Wednesday July 10, 2019 @02:00PM (#20404568)
If you use ESNI (that encrypts SNI field in SSL handshake) and the server uses ESNI, and you both use TLS 1.3 (that encrypts server certificate) then it is difficult to determine domain name. Latest Firefox supports both of there features, as well as DoH.
[ Parent | on HN ]
Re:British ISP Lobbyists Backtrack on Calling Mozilla a Vill... by slap on Wednesday July 10, 2019 @01:21PM (#20404121)
"Host:" is on the HTTP layer so it's also encapsulated inside HTTPS so...it's invisible from any sniffing attempt.
[ Parent | on HN ]