Padlocks, Phishing and Privacy; the Value Proposition of a VPN
You don&#x27;t really always need a VPN to bypass SNI based censorship since most implementations give-up on reading SNI when the <i>ClientHello</i> TCP segment is split over two IP packets [0] (apologies John Nagle [1]). Besides, there are various tricks just at the TCP-level that could be employed to bypass SNI related attacks [2] (though, a pretty competent firewall&#x2F;censor would remain unaffected, which is where ESNI comes in).<p>Re: DNS-layer security: It is really not that hard to bypass it and if folks are subject to phishing via IDN homographic attacks (ex: <a href="https:&#x2F;&#x2F;www.аррӏе.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.xn--80ak6aa92e.com&#x2F;</a>) or typo-squatting attacks (ex: googel.com) then it is time for Firefox to up its game and improve upon DoH to tackle those, as well. Extensions are helpful too, but how many people care enough to remember and install those [3]?<p>Between HSTS (or https-everywhere [4]), DoH (thanks Mozilla!), ESNI (thanks Mozilla!), and domain-fronting [5] (thanks CDNs!) we&#x27;ve got a pretty good VPN-free future to look forward to in terms of anti-censorship which is what most users use it for (sure, if you care enough to not leak your IP address, discounting the fact that device &#x2F; browser fingerprinting is a thing, then VPN helps, but by how much? [6]).<p>The VPN industry does a lot of &quot;scareware&quot; marketing, I feel, and ESNI is a potential existential threat to them. Time will tell.<p>[0] <a href="https:&#x2F;&#x2F;twitter.com&#x2F;vinifortuna&#x2F;status&#x2F;1304189371688660992" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;vinifortuna&#x2F;status&#x2F;1304189371688660992</a><p>[1] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Nagle's_algorithm" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Nagle's_algorithm</a><p>[2] <a href="https:&#x2F;&#x2F;geneva.cs.umd.edu&#x2F;posts&#x2F;china-censors-esni&#x2F;esni&#x2F;" rel="nofollow">https:&#x2F;&#x2F;geneva.cs.umd.edu&#x2F;posts&#x2F;china-censors-esni&#x2F;esni&#x2F;</a><p>[3] Not sure if uBlock Origin defends against such attacks, but wouldn&#x27;t it be rad if it did?<p>[4] <a href="https:&#x2F;&#x2F;www.eff.org&#x2F;https-everywhere" rel="nofollow">https:&#x2F;&#x2F;www.eff.org&#x2F;https-everywhere</a><p>[5] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Domain_fronting" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Domain_fronting</a><p>[6] <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=19601503" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=19601503</a>