Hacker News Reader

Comment by hitr | Hacker News Reader

In the article,testing the host header with different IP is done over http and not https.so i so it does not prove that Airtel is sniffing https traffic,isn't it ?

>curl -H "Host: thepiratebay.org" http://192.30.253.112/

May be I missed something. Technically it is possible block the traffic by looking at SNI[1] or simply block the ipaddress if it belongs to the blocked site.I always thought that every ISPs had to follow this because all ISPS are asked to block a list of such sites by the Supreme Court .

[]1 https://en.wikipedia.org/wiki/Server_Name_Indication

View on HN

It is possible for them to block the access to such a site using SNI, however they will not be able to do a man-in-the-middle attack (as it would be possible in this scenario) unless they could obtain a valid certificate for the site.

It can't sniff https traffic, except for basic metadata.

The point is that many sites using cloudflare talk to cloudflare over HTTP (while users get HTTPS), and airtel is sniffing that.

I wonder if there's any proposals/extensions for moving SNI into the encrypted part of the communication. The initial certificate would have to be keyed to the IP address of the server, or maybe something from DNS, and probably there are other complications too, but it'd at least reduce the amount of plaintext information transmitted with each connection.

> moving SNI into the encrypted part of the communication.

That's called host header :-)

hah, i was wondering the same :)

For HTTP, yes. There are thousands of other protocols that rely on TLS though.

Are there any other protocols that rely on SNI? Genuinely curious.

Moving SNI into the encrypted channel would require completely redesigning TLS's key negotiation mechanism.

The server wouldn't know which key to use to decrypt the rest of the message.

This has been discussed ad nauseum on the TLS-WG mailing list. Just search for "encrypted SNI". Or click here for ekr's initial email: https://www.ietf.org/mail-archive/web/tls/current/msg18633.h....

Reply on news.ycombinator.com