Hacker News Reader

Comment by drtgh | Hacker News Reader

Since Encrypted SNI was disabled in Firefox 85, all the hostnames are transferred in plaintext, even using HTTPS. It was also disabled from Firefox ESR 78 at one point around ESR 78.9

This Not only makes DNS over HTTPS absolutely useless, but it is also giving browsing information by duplicate, to the ISP, to the intermediaries and to the DNS providers.

From the article, "If you aren’t a Firefox user yet, you can download the latest version here to start benefiting from all the ways that Firefox works to protect you when browsing the internet"

I did not expected Firefox 90 forget about this matter and talk about protection, when they got rid of Encrypted SNI in FF 85 without warning, and without having any other alternative actively working.

We went from an incomplete solution (ESNI) to having nothing at all. Meanwhile ECH (encrypted client hello) keep sounding like vaporware by the moment. Please...

View on HN

ESNI wasn't just incomplete/providing partial protection it had interop/scaling problems that would have made it a bad thing to continue to promulgate. It was probably a smart move to cut the cord for the redo to ECH while ESNI had single digit percentage server support considering most of the waiting for ECH is for server support as well.

In the meantime DoH is still very useful for a typical end user. It is orders of magnitude more work to filter all web traffic for the SNIs than it is to literally get directly notified by the client when a new site is looked up. Not to mention it's nice to have the scale proven out independently instead of trying to throw the kitchen sink at privacy when everything is fully baked and hope nothing falls apart that day.

Read why here: https://blog.mozilla.org/security/2021/01/07/encrypted-clien...

This article and accompanying discussion is not about ESNI or ECH, nor about concerns thereof; it is about the W3 `fetch-metadata` specification that Firefox is implementing:

https://www.w3.org/TR/fetch-metadata/

If you'd like to start a discussion about ESNI/ECH, please either write a blog post or find one about this, and submit that to HN for discussion.

If ESNI is fundamentally flawed, how is it better than nothing at all? At that point isn't it just cargo cult "protection"?

You're gonna have to support the statement that ESNI is fundamentally flawed a bit better for that argument to work.

From Mozilla link above: Since publication of the ESNI draft specification at the IETF, analysis has shown that encrypting only the SNI extension provides incomplete protection. As just one example: during session resumption, the Pre-Shared Key extension could, legally, contain a cleartext copy of exactly the same server name that is encrypted by ESNI. The ESNI approach would require an encrypted variant of every extension with potential privacy implications, and even that exposes the set of extensions advertised. Lastly, real-world use of ESNI has exposed interoperability and deployment challenges that prevented it from being enabled at a wider scale.

So it should still make attacks harder even if possible so it's a win isn't it?

Not really, since now you're stuck maintaining this broken thing, and breaking user deployments for something that isn't valuable.

IMO, SNI should only be added at the firewall (using HTTPS proxy, for example), so the network operator can monitor/filter which hosts are being accessed.

This doesn't make any sense.

If you actually have a "HTTPS proxy" then the entire transaction is plaintext at that proxy, the operator can do whatever they want.

In particular they can choose whether they want to support protocol extensions like eSNI or ECH on either or both sides of the proxy.

If your idea is "But surely it should just pass through extensions it doesn't understand" what you've got there is nonsense, it isn't a "firewall" it's a dumpster fire. The extensions have meaning to the peers, if it tries to pass extensions through without understanding them it's now speaking gibberish to both sides.

Reply on news.ycombinator.com