Re:Why We Love QUIC and HTTP/3
by londons_explore on Sunday March 24, 2019 @12:49PM
(#19477300)
A few people have been very vocal about not encrypting the SNI. Mostly firewall makers who obviously want to sniff it...
[ Parent
| on HN ]
I have no idea how one could deploy website with encrypted SNI. A lot of companies and countries block websites. If they can't determine the website, they will block IP addresses and that will cause a lot of other websites to break. It might work for simple websites which don't share IP address with other websites (but why encrypt SNI then), but it won't work for CDNs.
Blocking IP addresses can be very problematic though.
If I understand it correctly, I think that countries might start to block ESNI altogether. If it is not widely implemented, websites/apps using it will standout which sadly could limit its adoption. For instance, if Signal decided to use ESNI, it will probably get blocked in those countries, but this can change if big companies wanted to use it. However, I still don't know how it will work exactly.
That sounds more like a feature than a bug.