Cloudflare, Mozilla, Fastly, and Apple Working on Encrypted SNI
Am I understanding this correctly, they propose a _esni TXT record for a domain containing a public key, which is used to encrypt SNI?<p>Who does this protect from?<p>ISPs that don&#x27;t want to give up spying obviously are monopolies, have enough power and can block DNS-over-HTTPS&#x2F;TLS and all 3rd party resolvers. So can censors. State actors can intercept DNS traffic even easier, since DoH&#x2F;DoT make it more centralized. IP address itself leaks so much information, that cleartext SNI might not be even needed after all (meaning you can still pinpoint a domain with high probability just by IP address).<p>Maybe this can help make collateral freedom a bit easier. But it&#x27;s already possible to achieve that with generated not known ahead throwaway domains, they are cheap compared to CDN&#x2F;cloud costs. And collateral freedom doesn&#x27;t really work against censorship all that well on its own, as centralization makes it easy to pressure CDNs and clouds to deny service to dissidents. Not enough collateral damage.