On: How to leak to the press

[fennecfoxen]

Just as true if they're using the real domain with a dedicated IP, right?

[jnbiche → fennecfoxen]

Nope, if they're not using SNI, you'd just see the IP address. Fire up Wireshark some time when you're browsing and watch what comes through.

[fennecfoxen → jnbiche]

> Nope, if they're not using SNI, you'd just see the IP address.

but that's my point... if you're not using SNI, there's only one SSL server on that IP address, and if reverse-DNS fails you, you can connect on port 443 and ask it for its certificate and it will give it to you...