Re: [TLS] About encrypting SNI

[Yoav Nir <[e-mail]>]

On May 21, 2014, at 9:18 PM, Brian Sniffen <[e-mail]> wrote:

>>>> One challenge is that botnets (that are conduits for most of the
>>>> spam) also have plenty of spare CPU capacity.
>>> 
>>> Yes, but each bad node's CPU capacity only outstrips many good node's
>>> capacities by a little bit---compared to network bandwidth, where
>>> very often botnets outstrip good nodes' capacity by orders of
>>> magnitude.  Of course the bad nodes will beat out cell phone CPUs; a
>>> client puzzle scheme has to be about, in some part, "acceptable
>>> losses."  If we can drop new mobile nodes and the botnet, but keep
>>> service up for (say) established connections and "real" computers,
>>> that may be okay.
>> 
>> I don't have hard data at hand, but my guess is that these days TLS
>> connections from mobile devices far outnumber TLS connections from
>> "real" computers. So that may not be okay.
> 
> 
> That doesn't seem to be the case.  See
> <http://www.akamai.com/html/io/io_dataset_v2.html#stat=browser&top=5&type=bar&start=20140305&end=20140405>.
> That's not for TLS alone, but Chrome + IE + FF is far greater than Mobile
> Safari + Android Webkit + all Others.  Given that, it would be
> surprising if Mobile TLS far outnumbered Desktop TLS.

That page you linked allows you to group by device OS, which shows 58.8% Windows and 8.4% for Mac OS X. There may be some 1% of desktop linux in those “Unknown” or “Other” categories.  So about 2/3 desktop computers.

But this data is for percentage of requests, not connections. I think mobile sites tend to be simpler and contain less resources than full sites,  Also mobile phones tend to run a lot of little apps that keep querying servers in the background, much more than desktop computers do, so it’s possible that in number of handshakes the score is more even. 

There’s also some skew in that an Intel processor running Android is counted as “mobile” but a tablet running Windows RT is counted as “desktop”, but those are still too rare to alter the results.

Yoav