When is hostname sent plaintext in non-SNI HTTPS? (The resolver, I suppose, but ...

Dylan16807 · on April 14, 2015

The certificate is sent before encryption is established.

But that's a red herring. Even if it was all kept encrypted, even if you ignored DNS and reverse DNS, you could connect to the IP yourself.

Yeah, technically there might be more than one hostname, but they're all related hostnames.

bandrami · on April 15, 2015

but they're all related hostnames

Huh? I used to have ~100 hosting clients per IP address, none of whom were in any way related to each other (other than in having chosen me as a hosting provider).

Dylan16807 · on April 15, 2015

That's not the common case, though, and is completely awful to use as an anonymity measure.

mark-r · on April 15, 2015

Actually I think it's quite common, it applies to any site not busy enough to justify a dedicated server. By the long tail principle that will be the majority of sites on the internet.

Dylan16807 · on April 15, 2015

Oh, I should be clear, I'm specifically talking about sites sharing a certificate. I know a lot of sites use shared hosting, but it's awkward to get a certificate for a pile of unconnected sites. Most of them will either not support HTTPS or require paying a couple dollars for an IP. (Or, these days, try to rely on SNI.)