Cloudflare, Mozilla, Fastly, and Apple Working on Encrypted SNI
Related&#x2F;relevant question.<p>A number of months ago I decided to finally begin researching a project I&#x27;ve had on the backburner for ages: a simple domain+IP bandwidth throughput counter for everything within my LAN. Basically I wanted to make a dashboard saying &quot;you exchanged this much data with this many IPs within the last 24h; here&#x27;s the per-IP and per-domain breakdown; here are the domains each IP served&quot;, that sort of thing.<p>Part of the motivation for this was to track down the headscratch-generating mysterious small amount of &quot;unmetered data&quot; my ISP reports each month (I don&#x27;t watch TV over the internet and cannot think of what else would be it), and the other part of the motivation was to satisfy idle curiosity and observe domain&lt;-&gt;IP cohesion&#x2F;fragmentation over time.<p>At the exact point I began my research TLS 1.3 had just been approved, and I rapidly realized my nice little idea was going to get majorly stomped on: the inspiration for the project, years ago, was the SNI field itself (hah).<p>5-10 years ago, I would have been able to route all my traffic through a gateway box, and passively watch&#x2F;trace (slightly behind realtime) everything via tcpdump or similar, catching DNS lookups and sniffing SNI fields. That would have handled everything.<p>Now, with encrypted SNI, and the upcoming DNS-over-HTTPS (seems I need to think ahead :&#x2F;), it looks like my (now irritatingly stupid-seeming) project will require me to generate a local cert, install it on all my devices, and get a machine beefy enough to keep line-rate speed while doing MITM cert-resigning.<p>And then, for the fraction of traffic my system reports as &quot;not signed by local cert&quot;, I&#x27;m just going to have to let that go, or I&#x27;ll break everything that uses cert pinning.<p>...which I wouldn&#x27;t be surprised if some programs eventually use with DoH lookups (using pinned certs fished out of DNSSEC for DoH makes sense).<p>I&#x27;m very very interested to know if there are any alternatives I can use. I realize, for now, that I can sniff for and collect DNS lookup results and associate these with IPs, but when will this break?(!)<p>Honestly HTTPS and security in general just seems like a gigantic mess. I say this not as a disrespect of the architecture, but more as a &quot;wow, this is just so hard to get right&quot;.