News for hackers. Stuff that matters.

A comment on VPNs on iOS are a scam. Parent comment

Re:VPNs on iOS are a scam by fpoling on Wednesday August 17, 2022 @02:47AM (#32493091)
To support multiple sites per IP the browser has to send DNS name of the site to the web server. Moreover, since certificates that the server uses for encryption depends on the site name, the name cannot be encrypted within HTTPS. So the browser sends the name in clear when initiating the connection. This is called SNI, server-name-identification.

It is possible to encrypt SNI, but most sites do not support that as the setup is non-trivial and error-prone.

[ Parent | on HN ]
Re:VPNs on iOS are a scam by agileAlligator on Wednesday August 17, 2022 @03:13AM (#32493236)
Huh

So HTTPS doesn't really stop tracking, it only prevents people from snooping on what data you are sending to and receiving from the website

[ Parent | on HN ]
Re:VPNs on iOS are a scam by rayhaanj on Wednesday August 17, 2022 @03:53AM (#32493541)
There has been some work on encrypted server name indication: https://www.cloudflare.com/learning/ssl/what-is-encrypted-sn...
[ Parent | on HN ]
Re:VPNs on iOS are a scam by hnzix on Wednesday August 17, 2022 @03:22AM (#32493296)
I use CloudFlare's 1.1.1.1 DNS to mitigate my ISP tracking the domains I visit. They have an iPhone app too. I don't know enough about the space to say whether it's 100% effective.
[ Parent | on HN ]
Re:VPNs on iOS are a scam by fpoling on Wednesday August 17, 2022 @05:40AM (#32494148)
Again, due to SNI tracking sites that one visits is possible even if DNS traffic is encrypted. At the very least one needs for the site to support ESNI or encrypted-site-name-identification.

But then in practice for ESNI to be effective one needs for the site to use CDN or similar solutions to ensure that there are a lot of sites for the given IP.

[ Parent | on HN ]