3 ms·
You could just as easily make df opt-in. Another way is to use “fake” cloudflare-df.com sni just like they are doing with cloudflare-ech.com outer sni
by dilyevsky 3y ago
You could just as easily make df opt-in. Another way is to use “fake” cloudflare-df.com sni just like they are doing with cloudflare-ech.com outer sni
- josephcsible 3y agoA designated domain for domain fronting is useless because it would immediately get added to every middlebox's list of blocked domains.
- KirillPanov 3y ago... and this is exactly what will happen to cloudflare-ech.com. I'm really disappointed with how the ECH spec panned out. It's almost like "make sure middleboxes and GFW can block this" was a hard requirement. They should've made the handshake look like a session resumption (i.e. pre-shared key), since those aren't required to send a server name.