5 ms·

DoH alone is not enough due to https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication being sent in plain tex

by madars 4y ago

DoH alone is not enough due to https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication being sent in plain text. Some day ECH (formerly, eSNI) should help with that.

erinnh 4y ago
I thought TLSv1.3 already encrypted the SNI?
- uup 4y ago
  It does
  - Varloom 4y ago
    ESNI is not implemented yet on any website. And there is no software support except beta versions of Chrome/Edge and you have to manually toggle flags in dev mode. All SNIs are passed as plain text to your ISP/VPN, even with DoH/TLS secure DNS enabled.
- detaro 4y ago
  No. ESNI is an later-created extension to TLS 1.3