Re:Tell HN: Domain fronting to be blocked on Azure
by Avamander on Saturday November 12, 2022 @10:08AM
(#33573748)
We have ECH (previously known as ESNI) now, is that not just domain fronting in a new form?
[ Parent
| on HN ]
Re:Tell HN: Domain fronting to be blocked on Azure
by theCrowing on Saturday November 12, 2022 @10:15AM
(#33573814)
Only for the legal stuff... so you will still get complaining comments.
Re:Tell HN: Domain fronting to be blocked on Azure
by cesarb on Saturday November 12, 2022 @01:23PM
(#33575580)
No, because with ECH/ESNI the hostname in both layers (the TLS connection and the HTTP Host header) still matches. The only difference is that the hostname on the both layers is no longer visible on the wire, while without ECH/ESNI the hostname on one layer (the HTTP Host header) is hidden but the hostname in the other layer (the TLS connection) is visible. And you could still do domain fronting even with ECH/ESNI (making the hostname on each layer differ), though it would be kind of pointless.