Hacker News Reader

No HTTPs is encrypted.

Edit oops I thought OP said what they communicate not what IP.

But how does that tie in with SNI? The specs say that the client sends the intended hostname as part of the TLS handshake, can the ISP sniff the hostname from that handshake?

[edit] as per wikipedia, https://en.wikipedia.org/wiki/Server_Name_Indication:

The desired hostname is not encrypted, so an eavesdropper can see which site is being requested. This helps security companies provide a filtering feature and governments implement censorship. [..] As of mid 2018, an upgrade called Encrypted SNI (ESNI) is being rolled out in an "experimental phase" to address this risk of domain eavesdropping. On March 1, 2019, Daniel Stenberg stated that Mozilla Firefox supports ESNI.

Which is why encrypted SNI is in development

Test for eSNI here: https://www.cloudflare.com/ssl/encrypted-sni/

You can sniff SNI which will still reveal hostnames. In certain cases though, you can use 'domain fronting'. That is using a different Host in the HTTPS header than is included in SNI. If that other hostname is served by the same ip address and certificate, then that server might just forward your HTTPS message to the host requested in the HTTPS header.

Reply on news.ycombinator.com