buh@lemmy.world to Firefox@lemmy.ml · 2 年前Say (an encrypted) hello to a more private internet.blog.mozilla.orgexternal-linkmessage-square65fedilinkarrow-up1643arrow-down17
arrow-up1636arrow-down1external-linkSay (an encrypted) hello to a more private internet.blog.mozilla.orgbuh@lemmy.world to Firefox@lemmy.ml · 2 年前message-square65fedilink
minus-squarepazukaza@lemmy.mllinkfedilinkarrow-up1·2 年前Wouldn’t it be better if reverse proxies simply had a “default key” meant to encrypt the SNI after an unencrypted “hello” is received? Including DNS in this seems weird.
minus-squarep1mrx@sh.itjust.workslinkfedilinkarrow-up1·2 年前What would stop a MITM attacker from replacing the key? The server can’t sign the key if it doesn’t know which domain the client is trusting.
Wouldn’t it be better if reverse proxies simply had a “default key” meant to encrypt the SNI after an unencrypted “hello” is received?
Including DNS in this seems weird.
What would stop a MITM attacker from replacing the key? The server can’t sign the key if it doesn’t know which domain the client is trusting.