O.k. before I comment I have to disclose that I sometimes work on blocking domain fronting abuse (here's a blog post from me - https://aws.amazon.com/blogs/secu

O.k. before I comment I have to disclose that I sometimes work on blocking domain fronting abuse (here's a blog post from me - https://aws.amazon.com/blogs/security/enhanced-domain-protections-for-amazon-cloudfront-requests/ https://aws.amazon.com/blogs/security/enhanced-domain-protec...) so I have a bit of an interest here. This is an interesting technique because it starts with the user and not the domain owner. The user creates a single-use domain to mask their own access to some website. Clever! but I'd be really wary about recommending this to someone who is trying to hide access from an oppressive regime. Websites often load all sorts of out of domain resources, and unless you're rewriting all of the HTML (and somehow all dynamically generated HTML) there's still going to be a lot of it. That Facebook example probably went and loaded a bunch of fbcdn.com resources. Seems worth a mention in the privacy section, especially for a post on the Tor project.