Hacker News Reader

Comment by thisgoodlife | Hacker News Reader

> the FQDN is sent plaintext as part of HTTPS.

Can you please elaborate on that? domain name is sent after ssl handshake, no? Why is it sent plaintext?

A given server might be hosting multiple websites, each with a different certificate (e.g. a CDN endpoint). It needs to know which certificate to present to the user. Therefore, during the initial TLS handshake, the client sends the server name (hostname) in plaintext in a field called the Server Name Indication (SNI). This is mandated by the fact that a certificate identifies a website, not a server.

This is distinct from the HTTP Host: header, which is sent inside the TLS session and therefore is encrypted along with the rest of the HTTP request.

SNI is an optional extension and is legal to be missing. No SNI - no problem.

You won't be able to reach any web server that is sharing more than one hostname per IP that way.

This includes all sites on a free Cloudflare plan to my knowledge.

Cloudflare terminates ssl at the edge, no? Then it has the private key and has no need to care about the site certificate. It just sends a certificate with all hosts in alt names.

Cloudflare has way more customers/hostnames than what would fit into a single X.509 certificate. (They actually do seem to do what you describe to support non-SNI clients, but not on their free tier.)

SNI also allows decoupling TLS and TCP termination, which in turn allows for shared IP addresses and load balancers without necessarily delegating TLS termination and exposing certificates to some shared host.

Nearly all browsers support SNI, there's most likely not even a hidden config to disable it.

Browser is not the only program that uses internet. For example, openssl doesn't send SNI by default.

Back in the day there was mostly only 1 website per IP, so when you connected over port 443 for HTTPS, the server would only have the one cert to give you.

One day people wanted to serve multiple websites from one IP, so they had browsers tell the server which site they are looking for (Server Name Indication); that way the server would know which SSL cert to send for the handshake.

SNI is still plaintext, it's a glaring privacy hole that most people aren't aware of. Encrypted SNI needs to come sooner.

Nope, encrypted SNI cannot work against GFW or pretty much any state censorship as the whole idea is bullshit and relies on everyone a) tunneling DNS queries to a centralized party, which itself only operates under the state's mercy, and b) everyone hosting on a single centralized party and c) this party randomizing IP addresses of web sites (none of the CDNs do that, because they want to avoid risking all of their IP ranges being banned by states because of a single website).

Oh gosh that sounds awful. I have to admit I was using "Encrypted SNI" in a general sense, I hadn't looked at the details of ESNI, the proposed solution. In my head encrypted SNIs was a somewhat straightforward problem to solve but thinking about it more it's a bit tricky. What you describe of ESNI sounds horribly convoluted :(

The key exchange and identification for encrypted X is always the hard part.

For encrypted SNI, keys are expected to be published via DNS, which GFW is happy to disrupt.

Once you get a key, you have to send the key identifier in the clear (otherwise, the service doesn't know how to decrypt; unless you want to just do trial decryption with all available keys and hope that doesn't use too much CPU); the key identifier becomes the enforcement target at this point, unless you're on a host that shares ESNI keys among the many sites it hosts and is not acceptable collateral damage.

No.

Cloudflare can explain it much better than me.

https://www.cloudflare.com/learning/ssl/what-is-sni/

No. It's part of the cleartext SNI header. There is a proposal to encrypt the SNI information, but afaik, it's not yet widely used.

https://en.wikipedia.org/wiki/Server_Name_Indication

If I can assume Bob has Alice's public key (and that DNS was gold and whatever; i.e. the same axiom ESNI has), then:

- DNS lookup for _esni.domain CNAME _esni.cloudflare.net,

- client connect to _esni.cloudflare.net via HTTPS and negotiate TLS with SNI rejected

- HTTP Host header contains desired target

Servers can trivially support the above "new" protocol (chances are they already do), no changes to DNS clients libraries or servers, and clients can support the new "encrypted SNI" by using OpenSSL APIs that already exist. GFW can't do anything unless cloudflare give them the key for _esni.cloudflare.net.

Everyone wins except the nerds who really wanted to make a new protocol. Oh and they need to walk back this stupid shit:

https://support.cloudflare.com/hc/en-us/articles/36002977947...

> Oh and they need to walk back this stupid shit

And the reason this stupid shit of preventing domain fronting was put in place is the exact reason why eSNI doesn't work, i.e. because it prevents state censorship and forces the state to instead block all the IP addresses in turn forcing companies to either cooperate with the state or expose enough identifying info to not interfere with state censorship.

He’s probably talking about the DNS lookup.

He is probably not. See your sibling comments.

Reply on news.ycombinator.com