Hacker News new | past | comments | ask | show | jobs | submit | Asseon's comments login

That does not seem to work according to ssllabs browser test.


I dont think this is correct. I added the boolean security.ssl.disable_session_identifiers set to true in Firefox 62.0.3 and ran the SSL Labs browser test here: https://www.ssllabs.com/ssltest/viewMyClient.html. With the boolean set to true, Session Tickts under the Protocol Details section says false. Toggling the setting back to false and rerunning the set showed Session Tickets Yes. So perhaps you had a typo in the seeting name?


Under Firefox 62.0 (64-bit), setting security.ssl.disable_session_identifiers=true, I also see "Session tickets" change from Yes to No. Thanks!


you are right, bad case of a Layer 8 issue.


I was unable to find one. Right now the only way seems to be to patch nss.


If your nginx version is 1.13 or newer than yes, that should be enough.

[0] http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_p...


Right now there are no benefits though. Because the browser sends the domainname you contact unencrypted via the TLS handshake due to SNI. So someone listing in to your communication will learn the hostname anyway.

I know people are working on encrypted SNI but that will take time.


Of course there are benefits.

Assume a large entity willing to do some mass surveillance (NSA, ...). Now with unencrypted DNS this entity just has to MITM a link on the last hop of a few DNS providers (Google, Cloudflare) and voila, the IP's of the clients and the domains visited are pouring in.

With encrypted DNS, for an entity to get the same amount of information they need to MITM a much larger amount of links.

Though I agree the benefits are clearly limited, the idea is to eliminate all weak links. If there are 2 broken windows in your house and you can fix one - why not do it?


> Right now there are no benefits though.

In terms of privacy, I would mostly agree. Using an authenticated channel to your resolver still protects against many common MitM vectors, so there's definitely a benefit there. Unlike DNSSEC, you're not dependent on the target domain being in the small subset of DNSSEC-enabled domains, not to mention that most client resolvers won't validate DNSSEC anyway.


Encrypted SNI will take years before it is in common usage.

If you're that concerned about privacy, you better use a VPN.


Not necessarily.

CDNs have been doing, and keep doing a great job at pushing new things forward.

Fastly, Cloudflare and Akamai already have implementations and test websites.


Russia tried that for 3 years, now they use normal time the hole year. It seems only "summer time" is not a good idea either.


Seems to be down here too (germany), at least the desktop client. The web client still works.


Yes but A5/1 is utterly brocken. Besides thanks to numerous attacks possible through SS7 you probably do not even need to break the encryption.


No attack is necessary, operators has taps for listening in. See "lawful interception".


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: