4 ms·

> Excluding leaks, the ISP does not see the hostnames Unfortunately they can, either through the unencrypted hostname passed in SNI or in the cert returned by

> Excluding leaks, the ISP does not see the hostnames Unfortunately they can, either through the unencrypted hostname passed in SNI or in the cert returned by the server .

codedokode 2y ago
In TLS 1.3 server certs are encrypted. And while browsers support ECH (Encrypted Client Hello) to encrypt SNI, almost no server supports it. Cloudflare has ECH disabled globally for some "issues" they do not disclose [1]. [1] https://developers.cloudflare.com/ssl/edge-certificates/ech/ https://developers.cloudflare.com/ssl/edge-certificates/ech/