4 ms·
The article does mention SNI encryption coming in TLS 1.3, and if I remember correctly, discusses how this will make the DoH and DoT privacy story stronger.
by bluejekyll 7y ago
The article does mention SNI encryption coming in TLS 1.3, and if I remember correctly, discusses how this will make the DoH and DoT privacy story stronger.
- badrabbit 7y agoMakes sense to block eSNI than DoH/DoT then?(for people that desire the blockage). Even without eSNI sites can use CDN s with CNAME records being used for the TLS SNI (e.g.: site.com has xxx.cloudfront.com as CNAME,browser connects to cloudfront with CNAME record in SNI but requests site.com in the http Host header to get the correct site...essentially domain-fronting). Even now many services use domain fronting. Law enforcement and IT/corp security alike need to focus on endpoints. Dragnet surveillance and perimitet filtering never did get the real bad targets.