With SNI, they can't easily see whether you're looking at https://en.wikipedia.org/wiki/Cat https://en.wikipedia.org/wiki/Cat or at https://en.wikipedia.org/wik

With SNI, they can't easily see whether you're looking at https://en.wikipedia.org/wiki/Cat https://en.wikipedia.org/wiki/Cat or at https://en.wikipedia.org/wiki/Pornography https://en.wikipedia.org/wiki/Pornography (just looking at the size is not enough; Wikipedia has millions of pages, thousands of then are changed every day, it has a variable-sized HTML comment, and the HTML size also changes when you're logged in), while with the triple handshake attack, they can see the full HTTP request and response headers, while avoiding most of the cost of being "in the middle" during the actual content transfer.