3 ms·
I imagine SNI too - which is in cleartext. There is encrypted SNI but I don't know how far that is along in terms of deployment. But really for a company like
by martinald 4y ago
I imagine SNI too - which is in cleartext. There is encrypted SNI but I don't know how far that is along in terms of deployment.
But really for a company like FB you could just blackhole their entire IP range(s) and/or AS (AS32934?) which would take everything offline very quickly.
- LinuxBender 4y agoCloudflare supports ESNI. AFAIK none of the mainstream browsers support ESNI by default. I believe the latest build of Firefox [1] may have an option in about:config to enable it. One could check if a website supports ESNI with [2] ESNICheck. Support for ESNI is still subject to change. [3] [1] - https://blog.cloudflare.com/encrypt-that-sni-firefox-edition/ https://blog.cloudflare.com/encrypt-that-sni-firefox-edition... [2] - https://esnicheck.com/ https://esnicheck.com/ [3] - https://serverfault.com/questions/976377/how-can-i-set-up-encrypted-sni-on-my-own-servers https://serverfault.com/questions/976377/how-can-i-set-up-en...
- XorNot 4y agoESNI is useless. Nobody cares that it's secret - they care that they don't know what you're doing. It removes plausible deniability, which means no more domain fronting bypasses. It's not enough to be "secure", you need to be able to hide in plain sight.