4 ms·

ESNI was dropped from the TLS1.3 spec. It is currently a draft protocol. Almost nothing supports ESNI yet. Chrome does not have it yet. Firefox does but it ver

ESNI was dropped from the TLS1.3 spec. It is currently a draft protocol. Almost nothing supports ESNI yet. Chrome does not have it yet. Firefox does but it very difficult to enable, there is a config flag but it does nothing on its own unless you also enable DNS over HTTP in Firefox. OpenSSL has no support for ESNI yet either. ESNI also never tells the user if it is working or not yet, making downgrades fairly easy. ESNI is a long way from being deployed, let alone useful.

moduspol 7y ago
They're Netflix, though, so they've got a lot of use cases where they control both ends of the connection (e.g. they've got a native app for the end user). If it's important to them to have ESNI support, they presumably could do it for those use cases.
middleclick 7y ago
CloudFlare has ESNI enabled (and so do websites hosted by it, like medium.com) so it's not as if no one is doing it.
- georgyo 7y ago
  If no clients support it, and you can't tell as a user if it is working, then effectively no one is using it.
  - middleclick 7y ago
    Firefox supports it and Chrome has plans to support it in the future. I agree that it's not much right now but it's a start.
  - shawnz 7y ago
    Firefox supports it, although currently only as a configurable. Users can test their ESNI support online here: https://www.cloudflare.com/ssl/encrypted-sni/ https://www.cloudflare.com/ssl/encrypted-sni/
    - georgyo 7y ago
      It is enabled and working in _my_ firefox. But, I encourage you to try to get it working in _your_ firefox, where that site says you are in fact using ESNI. It is trickier than just enabling a flag. If you think this means people are using it, sure. Firefox has ~9% of market share, and a very small percent (maybe 0.1%) of those users have correctly configured this, and when those users visit a page hosted by cloudflare they will may be use ESNI. That is in fact more than zero users. It is a very very small number today, but hopefully it will grow in the future. And while that page you link tests ESNI, I cannot verify that any other domain supports ESNI. I am unaware of any tooling that lets me test that today.
    - berti 7y ago
      > Firefox supports it Only if you use their built-in DoH resolver. The public keys for ESNI are distributed by DNS records and as I understand it there's a bunch of work to be done for Firefox to retrieve these records from classic DNS servers. That work has been classified P5 (we won't do it, but might accept patches)[0]. [0] https://bugzilla.mozilla.org/show_bug.cgi?id=1500289 https://bugzilla.mozilla.org/show_bug.cgi?id=1500289

moduspol 7y ago

They're Netflix, though, so they've got a lot of use cases where they control both ends of the connection (e.g. they've got a native app for the end user). If it's important to them to have ESNI support, they presumably could do it for those use cases.

middleclick 7y ago

CloudFlare has ESNI enabled (and so do websites hosted by it, like medium.com) so it's not as if no one is doing it.

georgyo 7y ago
If no clients support it, and you can't tell as a user if it is working, then effectively no one is using it.
- middleclick 7y ago
  Firefox supports it and Chrome has plans to support it in the future. I agree that it's not much right now but it's a start.
- shawnz 7y ago
  Firefox supports it, although currently only as a configurable. Users can test their ESNI support online here: https://www.cloudflare.com/ssl/encrypted-sni/ https://www.cloudflare.com/ssl/encrypted-sni/
  - georgyo 7y ago
    It is enabled and working in _my_ firefox. But, I encourage you to try to get it working in _your_ firefox, where that site says you are in fact using ESNI. It is trickier than just enabling a flag. If you think this means people are using it, sure. Firefox has ~9% of market share, and a very small percent (maybe 0.1%) of those users have correctly configured this, and when those users visit a page hosted by cloudflare they will may be use ESNI. That is in fact more than zero users. It is a very very small number today, but hopefully it will grow in the future. And while that page you link tests ESNI, I cannot verify that any other domain supports ESNI. I am unaware of any tooling that lets me test that today.
  - berti 7y ago
    > Firefox supports it Only if you use their built-in DoH resolver. The public keys for ESNI are distributed by DNS records and as I understand it there's a bunch of work to be done for Firefox to retrieve these records from classic DNS servers. That work has been classified P5 (we won't do it, but might accept patches)[0]. [0] https://bugzilla.mozilla.org/show_bug.cgi?id=1500289 https://bugzilla.mozilla.org/show_bug.cgi?id=1500289