[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #17069 [Applications/Tor Browser]: Use false SNI fields, DNS requests for all outgoing connections to cdn-hosted websites
#17069: Use false SNI fields, DNS requests for all outgoing connections to cdn-
hosted websites
--------------------------------------+--------------------------
Reporter: elypter | Owner: tbb-team
Type: enhancement | Status: new
Priority: Low | Milestone:
Component: Applications/Tor Browser | Version:
Severity: Normal | Resolution:
Keywords: | Actual Points:
Parent ID: | Points:
Reviewer: | Sponsor:
--------------------------------------+--------------------------
Comment (by tom):
The hard part is tor's SOCKs Optimistic Data (or at least I think that's
the name for the pat that's the problem.)
If we opened a circuit to a DNS name, and got passed back the IP address,
and then constructed the ClientHello and sent it down the circuit - we
could hardcode CloudFlare and Akamai's IP spaces and just omit a SNI when
talking to them. This might/would probably work, we'd have to test. I know
they strongly prefer having clients send SNIs, but I don't know if it's
absolutely required.
But since we send the ClientHello down the circuit before we've resolved
the name, we have to detect the use of a CDN based off the DNS name alone.
What does HTTPS Everywhere do for this?
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/17069#comment:9>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs