Post #3802152
2026-07-14 06:05 UTC
Hot Take: SNI in its current form is bad… The server name should not be transmitted in plain text. At least put it behind DH, so passive MITM sniffing doesn’t work anymore…
Replies (1)
-
@evilemily@misskey.sindastra.net 2026-07-14 06:38
@sigmasternchen@comfy.social I suppose it is like that because of conflicting interests. Modern firewalls often have L7 scanning using Suricata or Snort. While they won’t scan encrypted content, they do rely on reading SNI. In the field, this does make a big difference, actually! Of course, this opens up new vulns, yes. So I think having a plaintext SNI IS the wrong solution to a valid problem.