Hacker News Reader

Comment by chime | Hacker News Reader

Does this mean in SSL, the host name is not plain-text but in TLS it is?

To me, it seems better to use a possible-to-crack SSL with hidden hostname vs. hard/impossible to crack TLS where anyone can see I'm trying to go to https://anonymous-upload.wikileaks.org.

View on HN

If the host name is encrypted the server needs to provide an SSL certificate identifying itself before it knows what host the user will request. This works if there's only one host on that IP, but if there's a 1-to-1 mapping between hosts and IPs then an attacker can figure out you're going to anonymous-upload.wikileaks.org from the fundamentally public information that you're going to 190.93.240.19. The way to fix this is to use tor, not to go back to old versions of SSL.

https://en.wikipedia.org/wiki/Server_Name_Indication

Note that certificates are always sent in plain. If it's a CA-signed certificate it will always have a common name or subject alt name field that specifies what host it is for (or a wildcard), readable in plain.

If it's a self-signed certificate scrubbed from anything identifiable then a server could still try to correlate what website you visited by the public key from the certificate.

They can see that anyway if they intercept the traffic anyway, since the IP will be in all packets. Even better, the TCP connection will end up creating routing tables on all hops along the way.

Unless there are multiple secured domains hosted on that IP address, in which case knowing the domain would be extra information.

You can't have multiple secure domains on a single host which don't require the user to know a non-standard port without exposing the domain in plain text as part of SNI.

You can if you have a certificate with multiple domain names in the SAN[0] field.

[0] http://en.wikipedia.org/wiki/SubjectAltName

I don't get the comment how TCP creates routing tables but just having an IP address for HTTPS is not necessarily sufficient as you can have virtual hosts.

Anyone monitoring you will have seen your initial DNS query.

Reply on news.ycombinator.com