<story><title>Cloudflare, Mozilla, Fastly, and Apple Working on Encrypted SNI</title><url>https://twitter.com/grittygrease/status/1018566026320019457</url></story><parent_chain></parent_chain><comment><author>exikyut</author><text>Related&amp;#x2F;relevant question.&lt;p&gt;A number of months ago I decided to finally begin researching a project I&amp;#x27;ve had on the backburner for ages: a simple domain+IP bandwidth throughput counter for everything within my LAN. Basically I wanted to make a dashboard saying &amp;quot;you exchanged this much data with this many IPs within the last 24h; here&amp;#x27;s the per-IP and per-domain breakdown; here are the domains each IP served&amp;quot;, that sort of thing.&lt;p&gt;Part of the motivation for this was to track down the headscratch-generating mysterious small amount of &amp;quot;unmetered data&amp;quot; my ISP reports each month (I don&amp;#x27;t watch TV over the internet and cannot think of what else would be it), and the other part of the motivation was to satisfy idle curiosity and observe domain&amp;lt;-&amp;gt;IP cohesion&amp;#x2F;fragmentation over time.&lt;p&gt;At the exact point I began my research TLS 1.3 had just been approved, and I rapidly realized my nice little idea was going to get majorly stomped on: the inspiration for the project, years ago, was the SNI field itself (hah).&lt;p&gt;5-10 years ago, I would have been able to route all my traffic through a gateway box, and passively watch&amp;#x2F;trace (slightly behind realtime) everything via tcpdump or similar, catching DNS lookups and sniffing SNI fields. That would have handled everything.&lt;p&gt;Now, with encrypted SNI, and the upcoming DNS-over-HTTPS (seems I need to think ahead :&amp;#x2F;), it looks like my (now irritatingly stupid-seeming) project will require me to generate a local cert, install it on all my devices, and get a machine beefy enough to keep line-rate speed while doing MITM cert-resigning.&lt;p&gt;And then, for the fraction of traffic my system reports as &amp;quot;not signed by local cert&amp;quot;, I&amp;#x27;m just going to have to let that go, or I&amp;#x27;ll break everything that uses cert pinning.&lt;p&gt;...which I wouldn&amp;#x27;t be surprised if some programs eventually use with DoH lookups (using pinned certs fished out of DNSSEC for DoH makes sense).&lt;p&gt;I&amp;#x27;m very very interested to know if there are any alternatives I can use. I realize, for now, that I can sniff for and collect DNS lookup results and associate these with IPs, but when will this break?(!)&lt;p&gt;Honestly HTTPS and security in general just seems like a gigantic mess. I say this not as a disrespect of the architecture, but more as a &amp;quot;wow, this is just so hard to get right&amp;quot;.</text></comment>
<story><title>Cloudflare, Mozilla, Fastly, and Apple Working on Encrypted SNI</title><url>https://twitter.com/grittygrease/status/1018566026320019457</url></story><parent_chain></parent_chain><comment><author>tscs37</author><text>This is amazing work, can&amp;#x27;t wait for this to be finished and deployed on the internet. Together with encrypted DNS (DoT and DoH) we finally get fully confidential connections to a server without leaking anything other than Remote IP.</text></comment>