On 07/08/2021 03:50, Thorsten Glaser wrote:
(Considering SNI also leaks the vhost addressed by the end user, which is otherwise hidden with wildcard certificates or grouped with tone others in multi-subjectAltName certificates, it ought to have been anyway.)
Actually I consider certificates that authenticate anything except the specific web site to be a security liability in themselves. Whilst I'd never heard of SNI, and am only going on the description here, assuming that sending the login details is a bug in Lynx, and not in the SNI specification, it seems to me that they must have been introduced to bring back the proper authentication that was broken by virtual hosting.
Virtual hosts were never introduced to defeat traffic flow analysis. They are there for commercial reasons.
I'd also suspect that the sorts of sites people might not want to be associated with are either clustered on the same physical server, or mixed in with low volume sites, and an analysis of other traffic flow parameters could make a good stab at establishing when they are being accessed.
_______________________________________________ Lynx-dev mailing list [email protected] https://lists.nongnu.org/mailman/listinfo/lynx-dev
