Googling the subject "sniffing out / spying on SSL secured communications" one finds many references to being able to make some good guesses about the "target destination" once the path length is known/guessed.

  1. Would it help if one just would make the length (in terms of number of characters) unusually long, which is easy enough to do, so that this "length" of the URL does not fall into the usual patterns?

  2. Assume that a PHP application is sitting on "server1.com" and passes from there (that's where a sniffer would start looking) an API call via SSL to "server2.com". "server2.com" would do nothing else but taking that call and "translate" it to call "server 3.com" (also SSL secured) as the final recipient... Servers 1,2 and 3 are with different ISPs and in different geographic regions.

Would that make it seriously harder to trace where the request goes to (and the answer comes back from, assuming the return would follow the reverse way)?


P.S.: I am asking as we are discussing internally that (just) one aspect of "security" is to limit "the opponents" amount and quality of information he has about your system, which is much easier to assess once he knows where your system is sitting URLwise, hence our ongoing discussion about suitable strategies to obscure the "target destination" for the API call so that this destination is much less likely to be "investigated" about it's systems to identify it's weaknesses (which of course always do exist, to larger or lesser extent)


You're thinking of a reverse proxy. The submission target isn't the actual target but a proxy that relays the data to the actual target. I don't see the point of such strategy from a security point of you. The security of your system must not rely on it being obscure or hidden, it must be an intrinsic property of the system itself. The problem is that you're looking into this from the wrong angle; this has nothing to do with vulnerabilities in SSL/TLS.

Even if CRIME and BREACH never existed and no secrets in the SSL/TLS sessions were possible to reveal, all it takes is for someone to use your application to reveal the submission target server. Actually, they don't need to do that, they can simply look at the traffic to see where it's going. SSL/TLS doesn't hide the destination IP address, and the vast majority of DNS queries are sent in the clear.

This is just one layer of obscurity that should be discussed after the underlying security has been thoroughly assessed.

| improve this answer | |
  • Agree, Adnan, but that's what I said myself in my question already "...I am asking as we are discussing internally that (just) one (SIC !!!) aspect of "security" is to limit "the opponents" amount and quality of information he has about your system...". Of course it's foolish to rely on obscuring, but it can be ONE ASPECT of the security measures – user1402897 Nov 4 '13 at 12:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.