Blog post doesn't take into account TLS Server Name Indication means middlemen can still see hostnames about encrypted-dns HOT 8 CLOSED

updated my blog post to mention sni

from encrypted-dns.

It seems TLS 1.3 doesn't natively imply encrypted SNI either, and requires a DNS text record for the ESNI public key, or other new DNS record type for future ECH.
https://blog.cloudflare.com/encrypted-client-hello/

from encrypted-dns.

Seems like alpn is not deployed widely yet?

from encrypted-dns.

Can you shed some light on it? How does a packet with alpn look like? Is it always used by webservers?

from encrypted-dns.

Sorry my mistake, it's the Server Name Indication extension, though both extensions send their data in the ClientHello message before any negotiation of protocols/other extensions. That means they'd be sent even if not supported by the server

from encrypted-dns.

there's encrypted SNI though, a part of tls 1.3

from encrypted-dns.

yes, though TLS 1.3 not deployed everywhere (though granted Cloudflare makes up a lot for that)

from encrypted-dns.

That's what makes deep packet inspection much more useful afaik. Sad!

from encrypted-dns.