Memes

45625 readers

1102 users here now

Rules:

Be civil and nice.
Try not to excessively repost, as a rule of thumb, wait at least 2 months to do it if you have to.

founded 5 years ago

MODERATORS

[email protected]

1063

Cough Cough... Chrome... Chough... (slrpnk.net)

submitted 6 months ago by [email protected] to c/[email protected]

151 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 2 points 6 months ago* (last edited 6 months ago) (3 children)

But what's not encrypted by either is the Server Name Indicator or SNI, ie: the initial request to a webserver stating which host you're trying to reach at that IP, before establishing the TLS connection, contains the domain you'd requested via DoH/DoT, in plaintext.

[–] [email protected] 3 points 6 months ago (1 children)

encrypted SNI is a thing now.

[–] [email protected] 4 points 6 months ago

True. Known as Encrypted Client Hello now, as part of TLS1.3.

It seems many more browsers support it than last I'd looked. I'm curious to see how much of the general web has adopted support for it onnthe server side. I'll have to look into that more, and see what it'll take to setup for self-hosting.

[–] [email protected] 1 points 6 months ago

That is correct. HSTS helps to some degree but the very first request is still unprotected.

[–] [email protected] 1 points 6 months ago (1 children)

https://www.cloudflare.com/learning/dns/dns-over-tls/

If I understand it correctly DoH (which I use with NextDNS) should prevent ISP from snooping.

[–] [email protected] 1 points 6 months ago* (last edited 6 months ago)

It will prevent the ISP from snooping on, or tampering with, the DNS request. However when you go to use the IP you've retrieved via DoH/DoT; your first request establishing a TLS connection to that IP will contain an unencrypted SNI which states the domain you are trying to use. This can be snooped on by your ISP.