3 ms·
> but it would most likely be making decisions based on layer 4 (assuming it's not an SSL decrypting proxy) so it would affect any sites which have the IP addre
by Sohcahtoa82 4y ago
> but it would most likely be making decisions based on layer 4 (assuming it's not an SSL decrypting proxy) so it would affect any sites which have the IP addresses you specify
Not necessarily...if you're not using ESNI, then the traffic shaper could sniff the server name from the client hello message, then use the TCP sequence numbers to track the individual TCP connection.
- hunter2_ 4y agoOh nice. I knew about SNI but didn't realize there would be a perfectly persistent trail from that packet onward. If a site being shaped and a site not being shaped shared an edge server (say they both use Cloudflare or something) there's no chance that the TCP connection gets shared for both? Not disagreeing, just thinking out loud naively.
- Sohcahtoa82 4y ago> there's no chance that the TCP connection gets shared for both Not a chance. There is a possibility that the TCP sequence numbers between the two connections overlap, but it's so unlikely as to be negligible.
- hunter2_ 4y agoOh right... different local port number, too. It's been a while since I thought about sockets and stuff, living fully inside HTTP for so long!
- 1vuio0pswjnm7 4y agoWho is currently using ESNI. Cloudflare disabled it.
- mavhc 4y agoWhere has cloudflare disabled it? Can't see anything
- 1vuio0pswjnm7 4y agoThey have moved to from ESNI to ECH. ECH is being rolled out in stages. Maybe the rollout is complete by now. I don't know. ESNI was available worldwide. I used ESNI for years outside the browser with a custom openssl binary. Although both encrypt SNI, ESNI was less complex and is not compatible with the latest versions of ECH. https://defo.ie/ech-check.php https://defo.ie/ech-check.php