3 ms·
The filter looks at the SNI header during the TLS handshake. If it doesn't like the host it will reset the connection.
by discreditable 8y ago
The filter looks at the SNI header during the TLS handshake. If it doesn't like the host it will reset the connection.
- cesarb 8y agoDoes this mean you block all of Wikipedia? And what will you do once encrypted SNI becomes popular?
- discreditable 8y agoI don't block Wikipedia. I looked at some wire traffic and I can see the SNI header as normal in Firefox 67 and Chrome 72. I found a about:config flag to enable esni, toggled it, restarted the browser, and I still see the SNI. Using Cloudflare's ESNI checker it says my browser isn't using it. Ignoring ESNI will probably work fine for a good length of time. If pornhub implements it or something I'd probably have to revisit. Or, since I control the clients I might disable it in their browsers. If enough people bark up the filter vendor's tree I'm sure they'll add a checkbox to drop esni traffic. They added one for QUIC recently.