News for hackers. Stuff that matters.

A comment on The Kivaloo Data Store. Parent comment

Re:The Kivaloo Data Store by cperciva on Monday September 21, 2020 @04:16PM (#24547952)
Assuming your attacker can count bytes, there's no privacy added by using TLS to download static content from the Tarsnap website. There simply aren't enough similarly-sized files.
[ Parent | on HN ]
Re:The Kivaloo Data Store by fungizid on Tuesday September 22, 2020 @02:11AM (#24551434)
But such an attacker would need to know that the content was downloaded from the Tarsnap website, right? If TLS is configured with Encrypted SNI, the handshake no longer reveals server information and thereby TLS does add privacy.

(However, Encrypted SNI is not widely adopted yet.)

[ Parent | on HN ]
Re:The Kivaloo Data Store by cperciva on Tuesday September 22, 2020 @11:46AM (#24555903)
The IP address alone will tell you that they're accessing the Tarsnap website.
[ Parent | on HN ]
Re:The Kivaloo Data Store by fungizid on Tuesday September 22, 2020 @03:32PM (#24558808)
I had a wrong understanding of what Encrypted SNI does and does not do. Thank you for the response.
[ Parent | on HN ]