Re: Le grand méchant Mozilla

D'autres liens :

• RFC 8484: DNS Queries over HTTPS (DoH) https://www.bortzmeyer.org/8484.html qui pointe d'ailleurs vers :
• DNS Privacy Public Resolvers https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Public+Resolvers#DNSPrivacyPublicResolvers-DNS-over-HTTPS(DOH)
• DNS-over-HTTPS (DoH) Update – Recent Testing Results and Next Steps https://blog.mozilla.org/futurereleases/2019/04/02/dns-over-https-doh-update-recent-testing-results-and-next-steps/

Par ailleurs le lien ci-dessus vers Inside Firefox’s DOH engine indique :

It still leaks the SNI!
Yes, the Server Name Indication field in the TLS handshake is still clear-text, but we hope to address that as well in the future with efforts like encrypted SNI.

Qui est, il me semble (je suis un profane en la matière), une limitation existante de HTTPS que l'extension HTTPS Everywhere mentionnait déjà :

However, HTTPS Everywhere does not conceal the identities of the sites you access, the amount of time you spend using them, or the amount of information you upload or download from a particular site. For example, if you access http://www.eff.org/issues/nsa-spying and HTTPS Everywhere rewrites it to https://www.eff.org/issues/nsa-spying, an eavesdropper can still trivially recognize that you are accessing www.eff.org (but might not know which issue you are reading about). In general, the entire hostname part of the URL remains exposed to the eavesdropper because this must be sent repeatedly in unencrypted form while setting up the connection. Another way of saying this is that HTTPS was never designed to conceal the identity of the sites that you visit.
[...] If you want to protect yourself against monitoring of the sites you visit, consider using HTTPS Everywhere together with software like Tor.
https://www.eff.org/fr/node/93777#what-does-https-everywhere-protect-me-against

Si je recherche sur le Web « SNI Encryption in TLS » (fonctionnalité qui manquait encore à TLS 1.3) je tombe sur quelques liens complémentaires intéressants :

• Encrypted SNI Comes to Firefox Nightly https://blog.mozilla.org/security/2018/10/18/encrypted-sni-comes-to-firefox-nightly/
• Enable DNS over HTTPS and Encrypted SNI in Firefox https://miketabor.com/enable-dns-over-https-and-encrypted-sni-in-firefox/
• Encrypt it or lose it: how encrypted SNI works https://blog.cloudflare.com/encrypted-sni/

Si qq1 veut en faire une dépêche ou se joindre à celle-ci existante : https://linuxfr.org/redaction/news/https-tor-vpn-de-quoi-est-ce-que-ca-protege-exactement ça serait vraiement super !