<p><pre><code> <meta property="og:description" content="Search the web privately ...">
</code></pre>
Would be nice if Brave did not require SNI since this is considered a privacy concern by some folks.^1 Anyone sniffing the wire can see all the domain names to which the SNI user is connecting.^3 The other search engines do not require SNI, e.g., Google, Bing, DuckDuckGo, GigaBlast, Qwant, etc.<p>1. One example would be Cloudflare. Because some folks see SNI as a privacy concern, Cloudflare used to offer ESNI which was a way to encrypt SNI. It has since been discontinued while we wait for ECH. Some HN commenters will often try to argue that SNI is irrelevant to users without offering any evidence to support. Watch for it. For example, China found SNI was relevant enough to block ESNI. Apparently, China found it preferable to use SNI than to use only IP addresses, which of course are easy for websites to change. Go figure.<p><a href="https://mailarchive.ietf.org/arch/msg/tls/Dae-cukKMqfzmTT4Ksh1Bzlx7ws/" rel="nofollow">https://mailarchive.ietf.org/arch/msg/tls/Dae-cukKMqfzmTT4Ks...</a><p>SNI can be used for censorship purposes, among other things. Many search engines work without SNI. But not Brave.<p>NB. As I understand it, these browsers do not allow the user to enable/disable SNI on a per site basis; in some of them it is not even possible to disable SNI at all.^2 TLS might enable the user to hide web <i>pages</i> from the proverbial "MITM", but with SNI enabled it will not allow them to hide web <i>sites</i>.<p>2. Thus, even when Google, Bing, DuckDuckGo, GigaBlast, Qwant, Mojeek, etc., and millions of other websites do not require the user to send SNI in order to return SERPs or other pages, these browsers send it anyway. Brilliant.<p>3. SNI is different than DNS. DNS lookups can be done at a different time from when a user connects, if the user ever does connect. (Popular browsers are not good for this, of course.) Unlike DNS, SNI proves the user actually connected. Strangely, much effort has gone into encrypting DNS, while SNI, and to some extent TLS prior to version 1.3, leaks these same domain names on the wire, unencrypted.