4 ms·

No. It's part of the cleartext SNI header. There is a proposal to encrypt the SNI information, but afaik, it's not yet widely used. https://en.wikipedia.org/wi

• geocar 7y ago
  If I can assume Bob has Alice's public key (and that DNS was gold and whatever; i.e. the same axiom ESNI has), then: - DNS lookup for _esni.domain CNAME _esni.cloudflare.net, - client connect to _esni.cloudflare.net via HTTPS and negotiate TLS with SNI rejected - HTTP Host header contains desired target Servers can trivially support the above "new" protocol (chances are they already do), no changes to DNS clients libraries or servers, and clients can support the new "encrypted SNI" by using OpenSSL APIs that already exist. GFW can't do anything unless cloudflare give them the key for _esni.cloudflare.net. Everyone wins except the nerds who really wanted to make a new protocol. Oh and they need to walk back this stupid shit: https://support.cloudflare.com/hc/en-us/articles/360029779472#error1013 https://support.cloudflare.com/hc/en-us/articles/36002977947...
  • zzzcpan 7y ago
    > Oh and they need to walk back this stupid shit And the reason this stupid shit of preventing domain fronting was put in place is the exact reason why eSNI doesn't work, i.e. because it prevents state censorship and forces the state to instead block all the IP addresses in turn forcing companies to either cooperate with the state or expose enough identifying info to not interfere with state censorship.