Does this mean that this change will add yet another roundtrip?
No, it's bootstrapped from an additional DNS record type (which presumably would be returned alongside the A record).
Encrypted SNI Comes to Firefox Nightly
81–90 of 155 posts
Re: Encrypted SNI Comes to Firefox Nightly
#82As a cancer survivor, using the example of someone spying on your cancer.org visit as a motivation for encrypted SNI seems a bit excessive and insensitive. There are definitely more neutral ways of motivating eSNI than invoking the fear of a stranger finding out you or a loved one has cancer. Shame on Mozilla.
Re: Encrypted SNI Comes to Firefox Nightly
#83So what's the plan for when IPv6 gains more adoption and we don't need SNI as much since every site can have its own public IP address (thus making tracking easier, subverting the benefits of encrypted SNI). Do you think encrypted SNI and NAT will become preferred to using IPv6 for routing because of the privacy benefits of ESNI (either real or imagined, depending on who you trust, since this seems to be relying on c…
Problem is with IPv6 encrypted SNI won't mean anything because an IP address directly translates to a website so your ISP still knows what website you are on.
Re: Encrypted SNI Comes to Firefox Nightly
#84So what's the plan for when IPv6 gains more adoption and we don't need SNI as much since every site can have its own public IP address (thus making tracking easier, subverting the benefits of encrypted SNI). Do you think encrypted SNI and NAT will become preferred to using IPv6 for routing because of the privacy benefits of ESNI (either real or imagined, depending on who you trust, since this seems to be relying on c…
I think SNI will remain in fashion even after IPv6 is introduced globally. SNI works fine for plain IPv6 address. If you run multiple websites on a single server for example you can move your server to another IP address / host / datacenter, update the IP address in your DNS settings and you're done. If you use IPv6 for this purpose, every domain and subdomain need to be configured with a new IP address and need a sp…
Unless someone writes a CLI tool that automatically sets it up for you.
Re: Encrypted SNI Comes to Firefox Nightly
#85Earlier quoted context omitted.
None of this is tied to Cloudflare though. Or really to using a cloud provider at all. Of course, if you're not using a cloud provider, then the IP address can be used to figure out what the site is, but the point remains that you can pick from any cloud provider that supports ESNI (and, separately, pick from any DNS provider that supports DOH). At the moment if you want ESNI it looks like you have to use Cloudflare,…
> (and, separately, pick from any DNS provider that supports DOH). But why do I have to? I already have a trusted DNS resolver operated by myself wired to my OS. Why require the whole DoH rube goldberg machinery to let me try ESNI?
DNS is plaintext, like HTTP, so running your own resolves does nothing to protect your internet provider from selling your domains resolved list - in aggregate or in specific - to other companies for revenue.
There are three well-known trusted public DNS resolvers, run by Cloudflare, Verizon, and Google.
Which of those three would you encrypt your DNS traffic to, if those were the only three options available other than plaintext for all to see?
Re: Encrypted SNI Comes to Firefox Nightly
#86So what's the plan for when IPv6 gains more adoption and we don't need SNI as much since every site can have its own public IP address (thus making tracking easier, subverting the benefits of encrypted SNI). Do you think encrypted SNI and NAT will become preferred to using IPv6 for routing because of the privacy benefits of ESNI (either real or imagined, depending on who you trust, since this seems to be relying on c…
> So what's the plan for when IPv6 gains more adoption Our great great grandchildren will surely figure something out.
Right now > 30% of US traffic uses IPv6 so it's already happening.
Re: Encrypted SNI Comes to Firefox Nightly
#87So what's the plan for when IPv6 gains more adoption and we don't need SNI as much since every site can have its own public IP address (thus making tracking easier, subverting the benefits of encrypted SNI). Do you think encrypted SNI and NAT will become preferred to using IPv6 for routing because of the privacy benefits of ESNI (either real or imagined, depending on who you trust, since this seems to be relying on c…
You could ignore the eSNI on the web server completely if you wished. But even on HTTP servers serving only a single IP it is still typical to only respond to requests targeting the correct hostname (i.e. direct IP requests are bounced). There's numerous reasons to bounce direct (non-hostname) requests including: - Discourage users visiting via the IP Address, adding that to favorites, sharing it, etc. Making it diff…
>- Discourage users visiting via the IP Address, adding that to favorites, sharing it, etc. Making it difficult/impossible to migrate
That's not a reason to reject. That's a reason to issue a redirect. No regular user that would make the mistake of bookmarking an IP instead of a domain is going to know how to use an IP to get there in the first place.
>- Make it harder for databases to associate that IP Address with your site (for user privacy).
You're misunderstanding how these crawlers work. They don't just walk all IP addresses because that's a good way to get an abuse letter and because if there is no redirect to a domain they don't get the domain. These crawlers just follow links like any other and log the IPs they resolve to. The only way this helps user privacy is if there are no links to your site anywhere on the internet.
Re: Encrypted SNI Comes to Firefox Nightly
#88So what's the plan for when IPv6 gains more adoption and we don't need SNI as much since every site can have its own public IP address (thus making tracking easier, subverting the benefits of encrypted SNI). Do you think encrypted SNI and NAT will become preferred to using IPv6 for routing because of the privacy benefits of ESNI (either real or imagined, depending on who you trust, since this seems to be relying on c…
Problem is with IPv6 encrypted SNI won't mean anything because an IP address directly translates to a website so your ISP still knows what website you are on.
[deleted]
Re: Encrypted SNI Comes to Firefox Nightly
#89I would love to understand why Firefox keep adding support for CloudFlare specific features.
Re: Encrypted SNI Comes to Firefox Nightly
#90Is it me or... > If they’re willing to convert all their customers to ESNI at once Why does it seem like this is over-engineering at it's finest? Not only are CDNs now part of the problem/solution space, but they are now dictating. It is now that much harder to diagnose issues when they do crop up, instead of checking ping or nslookup. Now, you've got to see if the DNS-over-HTTPS/The DNS record itself/Host/client/any…
It's not you. It's a combination of startups and incumbent tech behemoths attempting to operate outside of the formalized process for internet standards by using their market power to push for the change they deem appropriate. There are benefits (censorship circumvention) to be reaped, but also great peril.
I'm very confused - are you saying that the announcement of experimental ESNI support is an example of companies "attempting to operate outside of the formalized process for internet standards"? If so, I really don't see how that is true - they implemented a draft IETF spec - https://datatracker.ietf.org/doc/draft-ietf-tls-esni/ - If that isn't working with a standards body, I'm not sure what is.