6 ms·
How is it a step down? Without SNI, the public IP you connected to also uniquely identified the domain/cert you were visiting.
by computer 12y ago
How is it a step down? Without SNI, the public IP you connected to also uniquely identified the domain/cert you were visiting.
- Scramblejams 12y agoYou are absolutely correct, but in practice I believe it often works out differently. I imagine that under pre-SNI conditions, many hotels/free hotspots/university/work firewalls don't go to the trouble to actually connect to the IP to see if it matches their list of bad actors. And that guess has often been borne out for me where, for example, http://youtube.com http://youtube.com is blocked but https://youtube.com https://youtube.com is permitted. With SNI, they can easily passively sniff the domain you want and block and/or log it, no active measures like reverse lookups or probing connections required. Edit: Actually now that I think about it, could they just sniff the certificate offered by the server and get the same info? If so that's unfortunate, but plenty of firewalls don't seem to be doing that, as I noted above with my youtube example.
- mseebach 12y agoIf it's equally possible to sniff out the domain name, what makes you predict that more operators would go through the trouble under SNI than did before? The sites in question will likely be blocked soon enough, but it won't be because of SNI being less secure, it will be because more and more traffic will default to TLS - a development helped along by SNI, certainly - and the operators will notice and the gateway providers will add the required sniffing, covering both "old school" certts and SNI.
- Scramblejams 12y agoYeah, I think you're right. Then we'll have a proposal for SNI2 and a multitude of people wishing it had been done right the first time.