Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Encrypted SNI Comes to Firefox Nightly

blog.mozilla.org

Post reply on HN
Print view View original

91–100 of 155 posts

Re: Encrypted SNI Comes to Firefox Nightly

#91

Post by dagenix »

nykolasz wrote: post #89

I would love to understand why Firefox keep adding support for CloudFlare specific features.

Thats not remotely true. ESNI is a draft IETF spec - https://datatracker.ietf.org/doc/draft-ietf-tls-esni/. It just so happens, that right now CloudFlare and Firefox are the ones that implement it. But any particular feature, regardless of how great it is or how well specified by a standards body, must have a first implementation by someone. And it's really not that shocking that a group like CloudFlare wants to be at the forefront of new web technologies AND also has the resources to pay for it. What does boggle the mind that is that everyone freaks out when a draft IETF standard is implemented. What do people want? For it to spring into existence fully formed implemented by all browsers, operating systems, DNS software and providers, etc all that once? That would be ridiculous - and worse, if there aren't a few experimental implementations to work out the issues, even if that could happen, what would be implemented would probably have significant issues that we'd then be stuck with forever.

Re: Encrypted SNI Comes to Firefox Nightly

#92

Post by dagenix »

tptacek wrote: post #69
tialaramex wrote: post #66

Earlier quoted context omitted.

One thing to pay attention to in Langley's post about DANE is that he says they can't do this reliably without a way to do DNS that doesn't break when you do anything more interesting than A lookups. This thread is about eSNI. Guess what, eSNI can't be done reliably without a way to do DNS that doesn't break when you do anything more interesting than A lookups. Fortunately, Firefox has a solution for that, DoH. Wait,…

DoH drastically reduces the impetus for the deployment of DNSSEC; it is essentially the 2018 answer to DNSCurve/DNSCrypt. Google and the Chrome team have been pretty clear about what they think about DANE's prospects moving forward. And, of course, you're misrepresenting Langley's blog post when you suggest that the only reason DANE isn't in Chrome is because of lookup reliability. Readers can just read the piece for…

And definitely read the post by Thomas Ptacek linked to from that article: https://sockpuppet.org/blog/2015/01/15/against-dnssec/. He makes the excellent point that DNSSEC (and thus DANE) doesn't get rid of CAs at all - it just makes whoever controls the domain into a defacto CA. Yeah, Comodo behaved badly as a CA - so, the browsers are in the process of no longer trusting it; imagine if DANE were in widespread use and Verisign behaved badly - the browsers really couldn't do anything about it at all unless they wanted to stop supporting .com - which is impossible.

"Let's get rid of CAs!" Sounds great. "Let's replace the CAs with a less accountable set of companies and governments that are harder to punish for bad behavior" doesn't sound so great. But thats what DANE is.

Re: Encrypted SNI Comes to Firefox Nightly

#93

Post by dagenix »

vetinari wrote: post #67
zamadatix wrote: post #65

Earlier quoted context omitted.

> There is no practical difference between blocking port 853 and blocking port 443 to well-known IPs. I'm going to split this up into two answers: 1) The problem for "coffee shop" guest style networks isn't so much that they care to purposefully block this type of DNS as much as it's already blocked by accident and it isn't going to get unblocked any time soon since (realistically) nobody manages these networks post…

I'm concerned mostly with 2, but in small businesses category. Many of them do not have proxy, SSL intercept or MDM (they manage their computers using plain old AD, plus some BYOB devices), and having to get one significantly ups the ante for them.

> having to get one significantly ups the ante for them.

I see this as a good thing. I do sympathize with small businesses that, when gaping holes in internet security are closed, are forced to retire technologies that exploited those holes. And I'm not being sarcastic about being sympathetic - businesses in this position would probably rather be spending their money on something else. But, these are security issues that impact everyone and leaving them unfixed just because it will negatively impact a group isn't a reasonable option.

Re: Encrypted SNI Comes to Firefox Nightly

#94

Post by rqs »

mholt wrote: post #27

So what's the plan for when IPv6 gains more adoption and we don't need SNI as much since every site can have its own public IP address (thus making tracking easier, subverting the benefits of encrypted SNI). Do you think encrypted SNI and NAT will become preferred to using IPv6 for routing because of the privacy benefits of ESNI (either real or imagined, depending on who you trust, since this seems to be relying on c…

> So what's the plan for when IPv6 gains more adoption and we don't need SNI as much since every site can have its own public IP address

Say sometimes I love to visit a very private website for my personal pleasure when I'm alone at night.

Without eSNI, when I type-in pornhub.com and hit enter, my buddy Bob who working for the ISP immediately knows and be very sure that I'm trying to accessing none other than pornhub.com. And then, with great confident, he greedily calling me for a live chat.

Bob is a ... special person. He might tell my mom about the pleasure thing, but not just that, he also secretly tracks my pleasure activities only to figure out the pattern using some sort of weird thing called machine learning, so he can show up in front of my door at the exact right time to share the pleasure with me.

I don't like that.

With eSNI, Bob only knows that I'm accessing 216.18.168.0. But when he tries to access the 216.18.168.0:80, he be greeted by a 403 error which says "Invalid Host".

A website may have many IP addresses, and an IP address can serve many websites. Because of that, now Bob can only know MAYBE I'm watching my little pleasure, oh wait, or maybe it's imworkingverylateatnight.com? He just can't be sure now.

Re: Encrypted SNI Comes to Firefox Nightly

#95

Post by koolba »

rqs wrote: post #94
mholt wrote: post #27

So what's the plan for when IPv6 gains more adoption and we don't need SNI as much since every site can have its own public IP address (thus making tracking easier, subverting the benefits of encrypted SNI). Do you think encrypted SNI and NAT will become preferred to using IPv6 for routing because of the privacy benefits of ESNI (either real or imagined, depending on who you trust, since this seems to be relying on c…

> So what's the plan for when IPv6 gains more adoption and we don't need SNI as much since every site can have its own public IP address Say sometimes I love to visit a very private website for my personal pleasure when I'm alone at night. Without eSNI, when I type-in pornhub.com and hit enter, my buddy Bob who working for the ISP immediately knows and be very sure that I'm trying to accessing none other than pornhub…

If Bob works at your ISP, he could see the DNS queries before you even connect to the site. There’s work arounds for that as well but the average Joe isn’t going to set any of them up.

Re: Encrypted SNI Comes to Firefox Nightly

#96

Post by dagenix »

comesee wrote: post #82

As a cancer survivor, using the example of someone spying on your cancer.org visit as a motivation for encrypted SNI seems a bit excessive and insensitive. There are definitely more neutral ways of motivating eSNI than invoking the fear of a stranger finding out you or a loved one has cancer. Shame on Mozilla.

That example does make a very strong case for the feature - which I guess was the point. But, the audience for the post already knows that encrypted SNI is and why it's important. And if they don't, a much more light-hearted example would do. And it's not like there is much of an anti-encrypted-SNI movement that warrants a powerful response.

So, yeah, I'd agree it seemed both jarring and unnecessary.

Re: Encrypted SNI Comes to Firefox Nightly

#97

Post by [deleted] »

koolba wrote: post #95
rqs wrote: post #94

Earlier quoted context omitted.

> So what's the plan for when IPv6 gains more adoption and we don't need SNI as much since every site can have its own public IP address Say sometimes I love to visit a very private website for my personal pleasure when I'm alone at night. Without eSNI, when I type-in pornhub.com and hit enter, my buddy Bob who working for the ISP immediately knows and be very sure that I'm trying to accessing none other than pornhub…

If Bob works at your ISP, he could see the DNS queries before you even connect to the site. There’s work arounds for that as well but the average Joe isn’t going to set any of them up.

[deleted]

Re: Encrypted SNI Comes to Firefox Nightly

#98

Post by rqs »

koolba wrote: post #95
rqs wrote: post #94

Earlier quoted context omitted.

> So what's the plan for when IPv6 gains more adoption and we don't need SNI as much since every site can have its own public IP address Say sometimes I love to visit a very private website for my personal pleasure when I'm alone at night. Without eSNI, when I type-in pornhub.com and hit enter, my buddy Bob who working for the ISP immediately knows and be very sure that I'm trying to accessing none other than pornhub…

If Bob works at your ISP, he could see the DNS queries before you even connect to the site. There’s work arounds for that as well but the average Joe isn’t going to set any of them up.

Of course. But what if DNS can also be encrypted?

Re: Encrypted SNI Comes to Firefox Nightly

#99

Post by yborg »

kardos wrote: post #59
tombrossman wrote: post #54

Earlier quoted context omitted.

Interesting that you mention the privacy risk of tracking, as this[0] just appeared in my Twitter feed at about the same time I was reading HN. "Tracking Users across the Web via TLS Session Resumption"[1]. A snippet from the abstract: "Our results indicate that with the standard setting of the session resumption lifetime in many current browsers, the average user can be tracked for up to eight days. With a session r…

> with the standard setting of the session resumption lifetime in many current browsers > seven days, as recommended upper limit Do we fix this by changing that setting to a few hours? Edit: the report discusses this: "The recommended upper limit of the session resumption lifetime in TLS 1.3 [19] of seven days should be reduced to hinder tracking based on this mechanism. We propose an upper lifetime limit of ten minu…

Is this a configurable option in Firefox?

Re: Encrypted SNI Comes to Firefox Nightly

#100

Post by comesee »

dagenix wrote: post #96
comesee wrote: post #82

As a cancer survivor, using the example of someone spying on your cancer.org visit as a motivation for encrypted SNI seems a bit excessive and insensitive. There are definitely more neutral ways of motivating eSNI than invoking the fear of a stranger finding out you or a loved one has cancer. Shame on Mozilla.

That example does make a very strong case for the feature - which I guess was the point. But, the audience for the post already knows that encrypted SNI is and why it's important. And if they don't, a much more light-hearted example would do. And it's not like there is much of an anti-encrypted-SNI movement that warrants a powerful response. So, yeah, I'd agree it seemed both jarring and unnecessary.

Yeah not sure why I'm being downvoted. Imagine if the example was HIV.org or ebola.org, totally doesn't seem necessary.
Post reply on HN