Cloudflare, Mozilla, Fastly, and Apple Working on Encrypted SNI
This doesn&#x27;t make much sense to me, I wonder if the senior management at these firms understand what the engineers are doing.<p>You could already do something approximating encrypted SNI using domain fronting. Connect to boring domain A via SSL, then send an HTTP request with a Host header set to your actual target domain B. Load balancing HTTP reverse proxies in the clouds would happily use the encrypted domain in the Host header, ignoring SNI in the TLS headers. This started being widely used to evade censorship and build &quot;unblockable&quot; services, because to block them you&#x27;d have to block all of Cloudflare or Akamai or Google.<p>These firms all, as one, banned domain fronting. Turns out the bosses wanted access to big markets more than they wanted censorship resistance.<p>So why do these developers think it&#x27;ll work out any differently this time, with slightly different packet formats? First company to enable encrypted SNI will get blocked at the national level and will blink. The others will look at it and probably never try.<p>If they&#x27;re serious about making sites unblockable by domain, the first step is to re-activate support for domain fronting and make a public commitment to keep it.