Comment on Let’s Encrypt Begins Supporting IP Address Certificates

bjoern_tantau@swg-empire.de ⁨3⁩ ⁨days⁩ ago

• dariusj18@lemmy.world ⁨3⁩ ⁨days⁩ ago

  What do you mean?

  source

  • Zagorath@aussie.zone ⁨3⁩ ⁨days⁩ ago

    In much simpler terms:

    Think of an IP address like a street address. 192 My Street.

    There might be multiple businesses at one street address. In real life we address them with things like 1/192 My Street and 2/192 My Street, but there’s no direct parallel to that in computer networks. Instead, what we do is more like directing your letter to say “Business A c/o 192 My Street”. That’s what SNI does.

    Because we have to write all of that on the outside of the envelope, everyone gets to see that we’re communicating with Business A. But what if one of the businesses at 192 My Street is highly sensitive and we’d rather people didn’t know we were communicating with them? @bjoern_tantau@swg-empire.de’s proposal is basically like if you put the “Business A” part inside the envelope, so the mailman (and anyone who sees the letter on the way) only see that it’s going to 192 My Street. Then the front room at that address could open the envelope and see that the ultimate destination is Business A, and pass it along to them.

    source

    • AnUnusualRelic@lemmy.world ⁨3⁩ ⁨days⁩ ago

      There’s Encrypted Client Hello, supported by major browsers that does the SNI encryption. It’s starting to be fairly widely supported.

      source
    • Vinstaal0@feddit.nl ⁨3⁩ ⁨days⁩ ago

      192 My Street

      Except that with street addresses there is such a lack of inconsistency on how they work and are written that it is funny

      source
  • bjoern_tantau@swg-empire.de ⁨3⁩ ⁨days⁩ ago

    Currently before establishing an encrypted connection to a webserver the domain is sent to the webserver unencrypted so that the server can choose the appropriate certificate to use for encryption. That is called SNI, Server Name Indication.

    Of course that’s a privacy risk. There are finally protocols to fix this but they aren’t very widespread and depend on DNS over HTTPS.

    I think issuing certificates based on the IP and sending the domain name encrypted based on that certificate could have fixed this issue ages ago.

    source