Hiding HOST Header from HTTP Request

Question

I would like to visit a site which supports HTTPS but to allow as few third-parties as possible to know which site I am visiting, excluding onion sites, through the HTTP Host Header.

As I currently know, the HTTP Host Header can be viewed in plaintext by anyone monitoring my network (when visiting HTTPS sites) and I would like to mitigate this as much as possible.

An inefficient solution I thought of would be to create an open-source website which supports SSL (say, HTTPHostHider.com) that creates the connection and securely transfers the requested site's public key to the client. Below is what I mean.

1. Client wants to see contents of example.com
2. Client request headers sent to https://HTTPHostHider.com
3. HTTPHostHider.com returns example.com response headers and public key
4. Client send encrypted contents to HTTPHostHider.com
5. HTTPHostHider.com sends request to example.com
6. example.com sends page contents to HTTPHostHider.com
7. HTTPHostHider.com sends page contents to client

from what I understand, if the client directly contacts https://example.com then the HTTP HOST header can be seen by eavesdroppers (and thus deduce what I was doing on that site - the URL reveals what it is for - eg. freeporn.org).

So my question is: How do I not leak my HTTP Host Header?

Sorry if question not clear; English is not my first language

Answer 1

As I currently know, the HTTP Host Header can be viewed in plaintext by anyone monitoring my network (when visiting HTTPS sites) and I would like to mitigate this as much as possible.

This is wrong. The HTTP Host header is part of the HTTP protocol and with a HTTPS connection all of the protocol is encrypted with SSL/TLS. Thus the host header is only visible for the endpoints of the SSL/TLS connection.

But inside the SSL/TLS handshake itself there are several parts which show the hostname in plain text: in most connections the ClientHello contains the name in the form of the SNI extension. The certificate send by the server then contains the name in the CN and/or subject alternative names. And even before the SSL/TLS connection is started a DNS lookup will be done to find out the target IP address and this lookup also shows the name in plain text.

So my question is: How do I not leak my HTTP Host Header?

The information need to be visible because they are required to establish the connection. The only question is who should see the information. If you fear sniffing by somebody on the way (i.e. ISP) you need to use a VPN, proxy accessed by HTTPS, Tor or similar to encrypt any data from you to some endpoint endpoint so that this specific party cannot see it. Once the connection left the endpoint all parties on the way can again see the information you want to hide so you need to take care where you place your endpoint.

An inefficient solution I thought of would be to create an open-source website which supports SSL (say, HTTPHostHider.com) that creates the connection and securely transfers the requested site's public key to the client.

A public proxy which can be accessed using HTTPS is mostly related to what you propose here, only that it would actually work. But this still leaves the problem why somebody should setup such a public site, because this way he might get liable for any illegal activity using this site. That's for example a typical problem when somebody is trying to setup a Tor exit node, because Tor is used to hide both legal and illegal activities.