Re: [TLS] About encrypting SNI

[Yoav Nir <[e-mail]>]

Hi

While I understand dkg’s argument for privacy in accessing sites on shared hosting, I don’t find that argument compelling.

What both web hosting providers and CDNs offer is not server name privacy. What they sell is cost reduction (because getting however many 9s they give you on your own servers would be way more expensive), and CDNs add reduced latency to that. Tacking on a security feature onto somebody else’s cost-cutting feature is not likely to provide good security (or privacy).

Hiding the SNI only helps if the same IP address has multiple properties, and access to those properties cannot be distinguished except by looking at the SNI. Suppose for example that the one “subversive” site on a server has a landing page with a certain size for the main HTML resource. Assuming everyone who lands there fetches the HTML page and none of the other sites has a landing page of the same size, you can pretty much find these people by traffic analysis. The hosting providers or CDNs will have to actively help make the sites resistant to identification through traffic analysis, and that is expensive to do and it is not what they’re selling. 

On balance, I think hiding SNI offers very little for the trouble it would take to make it happen. Perhaps a better privacy option would be to avoid sending SNI and then have the server demux based on an HTTP Host header. You will need some mechanism to associate the certificate that you’re getting with the property, and a DANE record might be able to help there.

Yoav