4 ms·
Makes sense to block eSNI than DoH/DoT then?(for people that desire the blockage). Even without eSNI sites can use CDN s with CNAME records being used for the T
by badrabbit 7y ago
Makes sense to block eSNI than DoH/DoT then?(for people that desire the blockage). Even without eSNI sites can use CDN s with CNAME records being used for the TLS SNI (e.g.: site.com has xxx.cloudfront.com as CNAME,browser connects to cloudfront with CNAME record in SNI but requests site.com in the http Host header to get the correct site...essentially domain-fronting).
Even now many services use domain fronting. Law enforcement and IT/corp security alike need to focus on endpoints. Dragnet surveillance and perimitet filtering never did get the real bad targets.