642
Say (an encrypted) hello to a more private internet.
(blog.mozilla.org)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 03 Oct 2023
642 points (98.9% liked)
Firefox
17302 readers
390 users here now
A place to discuss the news and latest developments on the open-source browser Firefox
founded 4 years ago
MODERATORS
All well and good, but sadly this relies on the hosts managing DNS to include specific entries in their DNS configuration for keys to use during the encryption process. Unfortunately the vast majority of hosts probably won't be bothered to do this, similar to DNSSEC.
Wouldn't it be better if reverse proxies simply had a "default key" meant to encrypt the SNI after an unencrypted "hello" is received?
Including DNS in this seems weird.
What would stop a MITM attacker from replacing the key? The server can't sign the key if it doesn't know which domain the client is trusting.