Re:Say (an encrypted) hello to a more private internet
by charleyablaze on Tuesday October 03, 2023 @12:51PM
(#37754414)
This prevents governments, ISPs, etc from identifying which websites people are visiting and censoring their connections. Firefox are enabling it by default.
Re:Say (an encrypted) hello to a more private internet
by tjrgergw on Tuesday October 03, 2023 @12:56PM
(#37754490)
Right because even with HTTPS, it's possible to know the domain you're accessing, even though you can't tell high individual urls you are accessing. Interesting.
Re:Say (an encrypted) hello to a more private internet
by taway1237 on Tuesday October 03, 2023 @01:31PM
(#37754975)
It's - technically - a problem with TLS, not HTTPS. TLS requires the server to pick a key way before user sends first encrypted bytes (like a HTTP host header). It's not a problem when every HTTPS server has another IP, but that internet is gone. So if there are two domains with different TLS certificated hosted on a single IP:port, the webserver has to guess which key to use (usually one is the default).
To fix this, SNI extension to TLS was introduced. Now TLS client will optionally send a plaintext domain name it tries to connect to, and the webserver picks a key for that domain. Which is nice but... now the client is leaking their domain name. Encrypted hello in TLS finally fixes this problem.
To fix this, SNI extension to TLS was introduced. Now TLS client will optionally send a plaintext domain name it tries to connect to, and the webserver picks a key for that domain. Which is nice but... now the client is leaking their domain name. Encrypted hello in TLS finally fixes this problem.
Sincerely, the CIA