Hacker News Reader

Comment by donatj | Hacker News Reader

The subsequent SSL requests still include the host in clear text, so while a move in the right direction, does little to stop request sniffing.

View on HN

Right now yes, but when Encrypted SNI is adopted then not anymore.

It seems that when DoH and ESNI become the defaults there won't be much sniffing going on? (Apart from looking at the IPs of course.)

Star or thumbs up these issues if you want ESNI to be prioritized more:

https://bugs.chromium.org/p/chromium/issues/detail?id=908132

https://github.com/openssl/openssl/issues/7482

Exposing the host if often not that much of a problem in my opinion. I doubt if there are any solutions to obfuscate the host, since packages just need to be routed somewhere. At least it wouldn't be a DNS problem, since for IP the same restrictions apply.

You still ultimately will be exposing server you're talking to by ip, right?

No, they only include the DNS server name in cleartext. (Unless I’m misunderstanding DoH)

The lookup is encrypted yes. Your actual subsequent request to the webserver you looked up the DNS entry for however exposes the host in clear text. This is how a lot of corporate firewalls sniff HTTPS requests for host without a root cert.

https://security.stackexchange.com/questions/86723/why-do-ht...

If you enable it in about:config, Firefox does support the Encrypted SNI proposal when used with DoH and providers that support it. It works for me on Firefox for Android.

https://blog.cloudflare.com/encrypted-sni/

Disclaimer: I work for Cloudflare, but not on this project.

ESNI is a great solution but unlike DoH it has yet to see wider adoption. I have it enabled and I have Firefox pointed to my local DoH server, the majority of the websites still reply with NXDOMAIN to the _esni query. Besides Cloudflare I've only found 1 other website that has it enabled.

Reply on news.ycombinator.com