As web users, what we say and do online is subject to pervasive surveillance. Although we typically associate online tracking with ad networks and other th
If a packet is traversing an ISP’s network the ISP should have to know where it is coming from and where it is going, right? So even if you “encrypt the first hello” packet, the ISP would still know where it was routed, right?
I’ll freely admit I have only a very basic (and likely outdated) understanding of IP networking, but I don’t see how this protects my browsing habits from my ISP. Even if they can’t understand my “hello” to lemmy.ml, they still know I’m talking to lemmy.ml’s IP address about something.
They would know you’re talking to that IP, not necessarily lemmy.ml. It is very common for multiple sites to be hosted on the same ip. The reason SNI exists is so the browser can tell the server which site it was looking for in an encrypted session. If it is 1:1 then it would be true.
If I understand correctly, someone other than your ISP could see the name of the website, since it isn’t encrypted. I think it would bounce through several servers that could possibly read the data.
Cloudflare fronts much of the internet, so all your ISP would see is that you connect to cloudflare, not which site you actually connect to.
In fact this was a big reason cloudflare and Amazon were angry with the signal foundation, for using domain front running, using the same trick in fascist countries to still be able to talk to signal servers
Yeah I think it has the same limitations that pretty much anything not through a vpn has because you still have to tell your isp where to send the data. Your isp will still see some things, even if it’s encrypted (metadata, DPI, habits, and things beyond my knowledge). This sounds like a step in the right direction for the majority of people though, even if it’s minor.
HTTPS already prevents them from knowing exactly what content you’re looking at. Hiding SNI prevents them from knowing exactly what site you are connecting to via HTTPS.
They can still figure that out if you’re using unencrypted DNS or if there is a 1:1 IP to rDNS mapping though.
If a packet is traversing an ISP’s network the ISP should have to know where it is coming from and where it is going, right? So even if you “encrypt the first hello” packet, the ISP would still know where it was routed, right?
I’ll freely admit I have only a very basic (and likely outdated) understanding of IP networking, but I don’t see how this protects my browsing habits from my ISP. Even if they can’t understand my “hello” to lemmy.ml, they still know I’m talking to lemmy.ml’s IP address about something.
What am I missing?
Your ISP is mostly going to be seeing AWS, Azure, GCP, Cloudflare, etc IP addresses.
They would know you’re talking to that IP, not necessarily lemmy.ml. It is very common for multiple sites to be hosted on the same ip. The reason SNI exists is so the browser can tell the server which site it was looking for in an encrypted session. If it is 1:1 then it would be true.
If I understand correctly, someone other than your ISP could see the name of the website, since it isn’t encrypted. I think it would bounce through several servers that could possibly read the data.
Cloudflare fronts much of the internet, so all your ISP would see is that you connect to cloudflare, not which site you actually connect to.
In fact this was a big reason cloudflare and Amazon were angry with the signal foundation, for using domain front running, using the same trick in fascist countries to still be able to talk to signal servers
Yeah I think it has the same limitations that pretty much anything not through a vpn has because you still have to tell your isp where to send the data. Your isp will still see some things, even if it’s encrypted (metadata, DPI, habits, and things beyond my knowledge). This sounds like a step in the right direction for the majority of people though, even if it’s minor.
I kind of see it like differentiating between them seeing lemmy.ml via this vs lemmy.ml/thing-i-want-private/peronal.html without it, but I could be wrong about that.
HTTPS already prevents them from knowing exactly what content you’re looking at. Hiding SNI prevents them from knowing exactly what site you are connecting to via HTTPS.
They can still figure that out if you’re using unencrypted DNS or if there is a 1:1 IP to rDNS mapping though.