The hostname you visit over HTTPS is sent in plain text
I had assumed, without ever checking, that the padlock meant nobody on the network could tell which site I was visiting. The connection is encrypted end to end, so surely the destination is part of what gets hidden. It is not. The name of the site you are asking for travels across the network in plain readable text, at the very start of every HTTPS connection, and I wanted to see it with my own…
The domain name of the website you are trying to access is transmitted in plain text when you connect to it using HTTPS. Despite the connection being encrypted end-to-end, the hostname is sent in clear, at the very beginning of each HTTPS connection, which was surprising to the author. This behavior is intentional and not a bug, as the server needs to know which certificate to send and requires the hostname before it can encrypt the connection.
The hostname is sent in the Server Name Indication (SNI) extension, which is sent in the TLS ClientHello message. This message is sent before any encryption happens, so no key or decryption is needed for the passive observer. The article also discusses how TLS 1.3, which encrypts more of the handshake, still leaves the ClientHello and the SNI exposed in plain text.
The article introduces Encrypted Client Hello (ECH) as a potential solution to this issue. ECH uses DNS records containing public keys to encrypt the real hostname, making it unreadable to passive observers.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
