Dissecting the SSL handshake

Re:Dissecting the SSL handshake by the_mitsuhiko on Monday June 18, 2012 @11:50AM (#4126977)

> When using SSL, the remote domain name is transferred over the wire in plain text. Anyone able to sniff the traffic can know exactly what domains you're looking at, even when you're using HTTPS.

Without SNI you can only have one domain name per IP so that security consideration is not really an issue.

[ Parent | on HN ]

Re:Dissecting the SSL handshake by majke on Monday June 18, 2012 @11:55AM (#4127007)

Well, what about wildcard certificates?

* Without SNI you know - guy A spoke to guy B, who is say facebook.

* With SNI you know - guy A spoke to guy B, who is facebook, and asked for myfavouriteuniquepics.facebook.com.

SNI may reveal some information.

[ Parent | on HN ]

Re:Dissecting the SSL handshake by AjithAntony on Monday June 18, 2012 @07:04PM (#4129045)

One certificate per IP.

Whether the from SNI or the cert itself, there could be a lot of info to be learned about what the user was trying to access.

[ Parent | on HN ]

Re:Dissecting the SSL handshake by rpsw on Monday June 18, 2012 @11:54AM (#4127004)

Well, you can use UCC/SAN certificates to support multiple domains under one IP.

[ Parent | on HN ]