3 ms·
The correct answer will be reverse, get rid of SNI completely and enforce ESNI everywhere. Most bad entity now only need to block ESNI, and then the client wil
by mmis1000 6y ago
The correct answer will be reverse, get rid of SNI completely and enforce ESNI everywhere.
Most bad entity now only need to block ESNI, and then the client will happily fallback to plain SNI.
If everyone enforce ESNI only, then it is not gonna going to work.
Just like nowadays, a browser can't view https site is completely useless because most of sites on internet were already encrypted(and the percentage is only going to be more) no matter how useful/useless the site is.
- josephcsible 6y agoWe don't need to kill regular SNI to fix that problem. If a site's DNS record indicates that it supports eSNI, and a connection with eSNI fails, then the browser should hard-fail. And middleboxes can't lie about whether a site supports eSNI, since that's protected by DNSSEC (and it should be coming over DoH anyway). This would break the bad actors without breaking every site that didn't upgrade to eSNI.
- mmis1000 6y agoAs long as plain SNI is still a option, bad actor will try to enforce you to use that. So they can do bad things. China seems already done that and blocked esni. And the sites eventually gave up esni because people complaining they can't connect to it. A deprecation likes that(ex. browsers nowaday marks every http site as unsafe) ensure it is not available to everyone. So some sort of these attacks never work.