Re:Tor Browser: a legacy of advancing private browsing innov...
by commoner on Saturday January 29, 2022 @05:42PM
(#30131327)
> And if I'm not mistaken, even on HTTPS sites, the domain is visible in the request in plaintext too.
I originally misread this sentence. Yes, HTTPS requests expose the domain/subdomain name in plaintext to support Server Name Indication, which allows a server to host multiple HTTPS sites.[1] The domain/subdomain name can be concealed from the ISP with Encrypted SNI,[2] which Cloudflare's 1.1.1.1 DNS resolver supports.
Firefox used to support ESNI as an about:config option, but in version 85, Firefox replaced it with support for an improved mechanism called Encrypted Client Hello.[3][4] ECH is not widely used yet, though Cloudflare is testing it on some of its servers.[5]
With DNS over HTTPS/TLS and ECH, the entire process of connecting to an HTTPS site can be done without leaking the domain/subdomain name to the ISP. The only remaining parts exposed in plaintext are the remote IP address and port.
I originally misread this sentence. Yes, HTTPS requests expose the domain/subdomain name in plaintext to support Server Name Indication, which allows a server to host multiple HTTPS sites.[1] The domain/subdomain name can be concealed from the ISP with Encrypted SNI,[2] which Cloudflare's 1.1.1.1 DNS resolver supports.
Firefox used to support ESNI as an about:config option, but in version 85, Firefox replaced it with support for an improved mechanism called Encrypted Client Hello.[3][4] ECH is not widely used yet, though Cloudflare is testing it on some of its servers.[5]
With DNS over HTTPS/TLS and ECH, the entire process of connecting to an HTTPS site can be done without leaking the domain/subdomain name to the ISP. The only remaining parts exposed in plaintext are the remote IP address and port.
[1] https://https.cio.gov/faq/#why-are-domain-names-unencrypted-...
[2] https://www.cloudflare.com/learning/ssl/what-is-encrypted-sn...
[3] https://blog.mozilla.org/security/2021/01/07/encrypted-clien...
[4] https://blog.cloudflare.com/encrypted-client-hello/
[5] https://blog.cloudflare.com/handshake-encryption-endgame-an-...