From: Jacob Champion <pchampion@vmware.com>
To: peter.eisentraut@enterprisedb.com <peter.eisentraut@enterprisedb.com>
To: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Subject: Re: SSL SNI
Date: Tue, 16 Feb 2021 23:01:36 +0000
Message-ID: <ef3d4b460ae7da59a8811f4e8e8fde0cd38a6cc8.camel@vmware.com> (raw)
In-Reply-To: <7289d5eb-62a5-a732-c3b9-438cee2cb709@enterprisedb.com>
References: <7289d5eb-62a5-a732-c3b9-438cee2cb709@enterprisedb.com>
On Mon, 2021-02-15 at 15:09 +0100, Peter Eisentraut wrote:
> The question I had was whether this should be an optional behavior, or
> conversely a behavior that can be turned off, or whether it should just
> be turned on all the time.
Personally I think there should be a toggle, so that any users for whom
hostnames are potentially sensitive don't have to make that information
available on the wire. Opt-in, to avoid having any new information
disclosure after a version upgrade?
> The Wikipedia page[1] discusses some privacy concerns in the context of
> web browsing, but it seems there is no principled solution to those.
I think Encrypted Client Hello is the new-and-improved Encrypted SNI,
and it's on the very bleeding edge. You'd need to load a public key
into the client using some out-of-band communication -- e.g. browsers
would use DNS-over-TLS, but it might not make sense for a Postgres
client to use that same system.
NSS will probably be receiving any final implementation before OpenSSL,
if I had to guess, since Mozilla is driving pieces of the
implementation.
--Jacob
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: pchampion@vmware.com, peter.eisentraut@enterprisedb.com
Subject: Re: SSL SNI
In-Reply-To: <ef3d4b460ae7da59a8811f4e8e8fde0cd38a6cc8.camel@vmware.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox