<story><title>Cloudflare, Mozilla, Fastly, and Apple Working on Encrypted SNI</title><url>https://twitter.com/grittygrease/status/1018566026320019457</url></story><parent_chain></parent_chain><comment><author>exikyut</author><text>Related&amp;#x2F;relevant question.&lt;p&gt;A number of months ago I decided to finally begin researching a project I&amp;#x27;ve had on the backburner for ages: a simple domain+IP bandwidth throughput counter for everything within my LAN. Basically I wanted to make a dashboard saying &amp;quot;you exchanged this much data with this many IPs within the last 24h; here&amp;#x27;s the per-IP and per-domain breakdown; here are the domains each IP served&amp;quot;, that sort of thing.&lt;p&gt;Part of the motivation for this was to track down the headscratch-generating mysterious small amount of &amp;quot;unmetered data&amp;quot; my ISP reports each month (I don&amp;#x27;t watch TV over the internet and cannot think of what else would be it), and the other part of the motivation was to satisfy idle curiosity and observe domain&amp;lt;-&amp;gt;IP cohesion&amp;#x2F;fragmentation over time.&lt;p&gt;At the exact point I began my research TLS 1.3 had just been approved, and I rapidly realized my nice little idea was going to get majorly stomped on: the inspiration for the project, years ago, was the SNI field itself (hah).&lt;p&gt;5-10 years ago, I would have been able to route all my traffic through a gateway box, and passively watch&amp;#x2F;trace (slightly behind realtime) everything via tcpdump or similar, catching DNS lookups and sniffing SNI fields. That would have handled everything.&lt;p&gt;Now, with encrypted SNI, and the upcoming DNS-over-HTTPS (seems I need to think ahead :&amp;#x2F;), it looks like my (now irritatingly stupid-seeming) project will require me to generate a local cert, install it on all my devices, and get a machine beefy enough to keep line-rate speed while doing MITM cert-resigning.&lt;p&gt;And then, for the fraction of traffic my system reports as &amp;quot;not signed by local cert&amp;quot;, I&amp;#x27;m just going to have to let that go, or I&amp;#x27;ll break everything that uses cert pinning.&lt;p&gt;...which I wouldn&amp;#x27;t be surprised if some programs eventually use with DoH lookups (using pinned certs fished out of DNSSEC for DoH makes sense).&lt;p&gt;I&amp;#x27;m very very interested to know if there are any alternatives I can use. I realize, for now, that I can sniff for and collect DNS lookup results and associate these with IPs, but when will this break?(!)&lt;p&gt;Honestly HTTPS and security in general just seems like a gigantic mess. I say this not as a disrespect of the architecture, but more as a &amp;quot;wow, this is just so hard to get right&amp;quot;.</text></comment>
<story><title>Cloudflare, Mozilla, Fastly, and Apple Working on Encrypted SNI</title><url>https://twitter.com/grittygrease/status/1018566026320019457</url></story><parent_chain></parent_chain><comment><author>Cyphase</author><text>It&amp;#x27;s great seeing more and more work being done to increase privacy and anonymity online, especially things like this which are about plugging smaller, less obvious holes. Nothing is perfect, but the harder it is for the snoops and spooks, the better.</text></comment>