My understanding of an SSL handshake goes a bit like this...
Everything after the https:// is encrypted. Client does a DNS lookup on the host, but the host name in the request is encrypted. The path is encrypted. The get parameters are encrypted. Everything is encrypted to the server in the request. Everything coming back from the server is encrypted as well.
Team SNI comes along and says, "But we don't really care about security! We want to host multiple domains on the same IP address! How will the server know where to direct the SSL request without the domains?"
And so, in the name of reusing an IP address, security is now compromised for the domain. It is sent outside the SSL request, in the clear.
Everything after the https:// is encrypted. Client does a DNS lookup on the host, but the host name in the request is encrypted. The path is encrypted. The get parameters are encrypted. Everything is encrypted to the server in the request. Everything coming back from the server is encrypted as well.
Team SNI comes along and says, "But we don't really care about security! We want to host multiple domains on the same IP address! How will the server know where to direct the SSL request without the domains?"
And so, in the name of reusing an IP address, security is now compromised for the domain. It is sent outside the SSL request, in the clear.
Is that about right? SNI on TOR? Nice one.