4 ms·
Nope, encrypted SNI cannot work against GFW or pretty much any state censorship as the whole idea is bullshit and relies on everyone a) tunneling DNS queries to
by zzzcpan 7y ago
Nope, encrypted SNI cannot work against GFW or pretty much any state censorship as the whole idea is bullshit and relies on everyone a) tunneling DNS queries to a centralized party, which itself only operates under the state's mercy, and b) everyone hosting on a single centralized party and c) this party randomizing IP addresses of web sites (none of the CDNs do that, because they want to avoid risking all of their IP ranges being banned by states because of a single website).
- kohtatsu 7y agoOh gosh that sounds awful. I have to admit I was using "Encrypted SNI" in a general sense, I hadn't looked at the details of ESNI, the proposed solution. In my head encrypted SNIs was a somewhat straightforward problem to solve but thinking about it more it's a bit tricky. What you describe of ESNI sounds horribly convoluted :(
- toast0 7y agoThe key exchange and identification for encrypted X is always the hard part. For encrypted SNI, keys are expected to be published via DNS, which GFW is happy to disrupt. Once you get a key, you have to send the key identifier in the clear (otherwise, the service doesn't know how to decrypt; unless you want to just do trial decryption with all available keys and hope that doesn't use too much CPU); the key identifier becomes the enforcement target at this point, unless you're on a host that shares ESNI keys among the many sites it hosts and is not acceptable collateral damage.