Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Encrypted SNI Comes to Firefox Nightly

blog.mozilla.org

Post reply on HN
Print view View original

1–10 of 155 posts

Re: Encrypted SNI Comes to Firefox Nightly

#3

Post by e1ven »

I'm curious why this is tied to DNS-over-HTTPS.

It looks like Cloudflare is including a public key in the DNS lookup, which is used to encrypt the SNI information.

Couldn't this key be stored in a TXT record for normal DNS lookups as well?

Re: Encrypted SNI Comes to Firefox Nightly

#4

Post by rickbutton »

e1ven wrote: post #3

I'm curious why this is tied to DNS-over-HTTPS. It looks like Cloudflare is including a public key in the DNS lookup, which is used to encrypt the SNI information. Couldn't this key be stored in a TXT record for normal DNS lookups as well?

If the public key was stored in a TXT record and accessed via regular DNS, then someone snooping the connection could see that you made a DNS lookup for that domain, and could make the reasonable assumption that you were about to make a request to said domain.

Re: Encrypted SNI Comes to Firefox Nightly

#6

Post by markovbot »

rickbutton wrote: post #4
e1ven wrote: post #3

I'm curious why this is tied to DNS-over-HTTPS. It looks like Cloudflare is including a public key in the DNS lookup, which is used to encrypt the SNI information. Couldn't this key be stored in a TXT record for normal DNS lookups as well?

If the public key was stored in a TXT record and accessed via regular DNS, then someone snooping the connection could see that you made a DNS lookup for that domain, and could make the reasonable assumption that you were about to make a request to said domain.

Not if you use DNS-over-HTTPS, as is required to turn this on in Firefox

Re: Encrypted SNI Comes to Firefox Nightly

#7

Post by erinnh »

rickbutton wrote: post #4
e1ven wrote: post #3

I'm curious why this is tied to DNS-over-HTTPS. It looks like Cloudflare is including a public key in the DNS lookup, which is used to encrypt the SNI information. Couldn't this key be stored in a TXT record for normal DNS lookups as well?

If the public key was stored in a TXT record and accessed via regular DNS, then someone snooping the connection could see that you made a DNS lookup for that domain, and could make the reasonable assumption that you were about to make a request to said domain.

Could also use DoT - DNS over TLS.

Otherwise, this sounds suspiciously a lot like DANE, which cert authorities hate, since there would be no use for them.

https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na...

Re: Encrypted SNI Comes to Firefox Nightly

#8

Post by erinnh »

markovbot wrote: post #5

This sounds great. Does anyone know if any web servers are planning on implementing it?

I have heard Googles boringssl already supports it, but I have found no actual evidence of that.

Cloudflare apparently does support it already for all their websites though. (or at least the ones that use cloudflare dns also)

https://blog.cloudflare.com/encrypted-sni/

Re: Encrypted SNI Comes to Firefox Nightly

#9

Post by rickbutton »

markovbot wrote: post #6
rickbutton wrote: post #4

Earlier quoted context omitted.

If the public key was stored in a TXT record and accessed via regular DNS, then someone snooping the connection could see that you made a DNS lookup for that domain, and could make the reasonable assumption that you were about to make a request to said domain.

Not if you use DNS-over-HTTPS, as is required to turn this on in Firefox

right, DNS-over-HTTPS solves this particular problem.
Post reply on HN