Hacker News Reader

"We know you're worried about security, and so are we."

Please enable https for your website. Even the fact that I am looking at your site might interest others on or near my network.

Thank you.

View on HN

Can https hide that you look at a web site? How?

It can. The domain name is not sent in the clear in an HTTPS request. Instead, the connection is opened against the IP address and the domain name is moved to a Host: header which is encrypted.

SNI sends the server name in plain text

Correct (I considered explaining SNI but ultimately didn't bother), and a determined attacker could probably figure out a large number of the sites you visit by the IP as well.

Right, and even still it's pretty trivial to reverse a domain from an IP address in most cases.

Reply on news.ycombinator.com