2 ms·
Until encrypted SNI/encrypted client hello is a thing, the hostname is still sent in the clear. Also, it can still be DNS blocked - just because you use Cloudf
by Nextgrid 4y ago
Until encrypted SNI/encrypted client hello is a thing, the hostname is still sent in the clear.
Also, it can still be DNS blocked - just because you use Cloudflare's DNS doesn't mean they can't rewrite the responses as they still transit unencrypted. You'd have to use DNS-over-HTTPS or DNS-over-TLS to work around that.
- foepys 4y agoLuckily, ESNI is being supported by an increasing number of implementations.
- neilalexander 4y agoI believe China's answer to ESNI is just to block all traffic that attempts to handshake with ESNI, so it still won't necessarily get you anywhere.
- foepys 4y agoOnce everything is using ESNI this isn't a problem anymore. It's the lack of implementation that is currently the problem.
- 1vuio0pswjnm7 4y agoIf it's TLS1.2, certificates containing CNs and/or SANs are sent in the clear too.