I wish browser vendors would collectively pick some date in the future to make eSNI/ECH mandatory for HTTPS connections. Force China to either block the entire West, or not block anything at all.

Agreed.

I’m hoping in my lifetime the great firewall is destroyed. I’m also hoping for a united Korea. But I’m a dreamer.

"You may say I'm a dreamer But I'm not the only one I hope someday you'll join us And the world will be as one"

:-)

This explanation of this as a "second system" in the form of a "backup middlebox" feels extremely strange, as the behavior described--particularly how the "two" mechanisms are contingent: if the "primary" happens the "backup" does not (which the authors keep noting and seem to think is very surprising, due to their assertion that this is two otherwise separate middleboxes)--makes it feel like this is much more likely to be a single middlebox doing some stateful flow analysis that bails after deciding to kill a connection.

It's quite terrifing understand how the China state is trying to spy/sniff/obserbve/censure you inside one of the most freedom expression: internet. The more tricks the devs found to improve your privacy (eSNI/DoH/HTTPS/recursiveDNS/etcc...) the more China invests time and money to track and spy on you. if only they used their time to make something usefuel for all the people and not to try to pursue a new privacy feature invented by the "free developers".

During the TLS handshake, is the server's TLS certificate sent encrypted? If sent in plaintext, it seems to me, the GFW could easily block connections based on the certificate, even if eSNI is used.

Based on this [1] description of the handshake, the DH random values are exchanged before the certs, so they could in principle encrypt the certs. But it doesn't say if this is actually been done.

[1] https://docs.microsoft.com/en-us/windows/win32/secauthn/tls-...

ESNI is being replaced with ECH. The certificate is encrypted in TLS 1.3.

https://blog.cloudflare.com/encrypted-client-hello/

Ah, that makes sense. If I understand that right, the certificate was also already encrypted in ESNI (figure 2).