Chrome deploys deep-linking in latest build despite privacy concerns

Re:Chrome deploys deep-linking in latest build despite priva... by tootie on Friday February 21, 2020 @01:15PM (#22385325)

You don't send URLs or query parameters to a DNS server. Only a hostname. Also, it's usually cached after the first lookup. Sniffing the network will only requests to that IP. Hostnames, URLs, params and responses are all fully encrypted if they're on https.

[ Parent | on HN ]

Re:Chrome deploys deep-linking in latest build despite priva... by bradyd on Friday February 21, 2020 @02:19PM (#22385887)

Hostnames are not encrypted in HTTPS requests. They are sent in plain text via SNI (Server Name Indication). There is a new way of handling this called ESNI that does encrypt it, but I'm not sure how widely that is supported.

Edit: Cloudflare has a page to check if ESNI is supported by your browser. I tested it in the latest version of Firefox, Chrome, and Safari and it failed the test in all three.

https://www.cloudflare.com/ssl/encrypted-sni/

[ Parent | on HN ]

Re:Chrome deploys deep-linking in latest build despite priva... by tootie on Friday February 21, 2020 @03:32PM (#22386424)

Ooooh, you're right. I didn't think of SNI.

[ Parent | on HN ]