Hacker News new | past | comments | ask | show | jobs | submit login

It hides the domain too, in the literal HTTP request.

What it doesn't hide is the DNS lookup for that domain. You still have to translate a hostname into an IP address.

This might be a concern for certain uses. But at least it's on another port and protocol and not directly related to the HTTP request itself.




No, HTTPS has the domain in plaintext. There is a plan to fix this (Encrypted Client Hello), but AFAIK it's not widely used yet.


Ah yes, apologies. Again, it's not strictly part of the HTTP request, but part of the TLS handshake around it. And only part of the TLS handshake as part of SNI, if supported (which is true by default).

> "Server Name Indication payload is not encrypted, thus the hostname of the server the client tries to connect to is visible to a passive eavesdropper."

https://en.wikipedia.org/wiki/Server_Name_Indication

So you're right, this is more aligned to the HTTP request than the DNS resolution of hostname that I mentioned. Strictly speaking, it's not part of HTTP per se (it's part of TLS), but still, it's in the same request in the most common definition, as you are saying.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: