4 ms·

TLS v1.3 finally addresses this, https://blog.cloudflare.com/encrypted-sni/ https://blog.cloudflare.com/encrypted-sni/

• yardstick 7y ago
  I expect this will only work until the government in question is sufficiently angered that they just outright block the entire AWS infrastructure. Or whoever else supports ESNI.
  • Spivak 7y ago
    But the only reason domain fronting works in the first place is because people think that large web hosting providers are too large to block. If a hypothetical tyrantical government was willing to block all of Amazon S3 this change doesn't affect anything.
    • yardstick 7y ago
      If it impacted Amazon’s (or whoever is targeted) bottom line then I would expect they would be open to dropping domain fronting support. But I admit I don’t know this for sure - time will tell. China has blocked GitHub and Akamai before. https://www.latimes.com/business/technology/la-fi-tn-great-firewall-china-censorship-20141126-story.html https://www.latimes.com/business/technology/la-fi-tn-great-f...
  • shawnz 7y ago
    But the alternative, which is to just not force this virtual host change in the first place, similarly might have gotten AWS blocked from those countries anyway
• samat 7y ago
  We need this in Chrome, badly.
• tialaramex 7y ago
  TLS 1.3 was completed, published as RFC 8446 but eSNI is still a work in progress. You need TLS 1.3 because in prior versions the certificate is transmitted plaintext, but eSNI itself is not part of TLS 1.3 and is still actively being worked on as https://datatracker.ietf.org/doc/draft-ietf-tls-esni/ https://datatracker.ietf.org/doc/draft-ietf-tls-esni/
  • deleted 7y ago
    [deleted]