3 ms·
Yeah but I was like, ISPs have the ability to just start arbitrarily blocking websites that fast? DPI? DNS? etc
by aaomidi 3y ago
Yeah but I was like, ISPs have the ability to just start arbitrarily blocking websites that fast?
DPI? DNS? etc
- mvkg 3y agoAs of TLS 1.3, the ClientHello (which includes the Server Name Identification (SNI) extension) is still sent in plaintext. There is a current draft for encrypted client hellos[0], but I don't think its adoption is widespread. QUIC appears to encrypt the ClientHello; however, it does not protect from an attacker which can observe the initial connection packets[1]. [0]: https://datatracker.ietf.org/doc/draft-ietf-tls-esni/ https://datatracker.ietf.org/doc/draft-ietf-tls-esni/ [1]: https://www.rfc-editor.org/rfc/rfc9001.html#name-security-of-initial-message https://www.rfc-editor.org/rfc/rfc9001.html#name-security-of...
- aaomidi 3y agoYep! The WG last call is happening now. Even so, I don't think many ISPs have the capability to do the DPI for observing SNI on a moments notice.