>The examples section says > A host that serves many subdomains with a single wildcard certificate > could set the SNI of all subdomains to the same fixed subdomain, in > order to prevent a passive adversary from learning which subdomain a > user is accessing.
> I think that's a worthwhile benefit that would help real users today. And then the server trusts the Host header? That probably works if the server has a definitive list of the hosts it serves. But do not that there can be issues with "just trusting" the Host header. For example, in a CDN you need to make sure that you don't become an open proxy. But I do think that this might be the most likely privacy benefit -- aggregation into a larger anonymity set -- and should be up earlier in the document, or at least telegraphed :) _______________________________________________ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls
