ESNI to the rescue?

> ESNI to the rescue?

IIRC, it's now called ECH, because AFAIK the focus changed from "encrypt the SNI" to "encrypt the whole Client Hello".

Uh, no, the focus changed to don't encrypt the outer SNI but pretend we're encrypting something that will prevent filtering, even though it won't.

Isn't the outer SNI something that can be deduced from the IP address anyway?

Can you elaborate? I have not kept up with the eSNI/ECH stuff... How will filtering still be possible?

Do you have more details on that ?

Computer Scientists pick the best names for things

Modern deep packet identification gear looks at packet size and pacing to distinguish video traffic patterns. It is possible to fool these systems, but it is not trivial.

Any reason fast.com couldn’t stream a video as the test content?

Yes, this is exactly what it does, and it's a very clever trick by Netflix to discourage their traffic from being throttled!

I think it does pull a real video, I'm not sure its pulled in the same way the actual Netflix video player would do it.

you wouldn't pull at gigabits/s bandwidth when casually watching netflix

dunno about netflix, but youtube usually does. They send you a chunk of data as fast as possible, and then send nothing till your client requests the next chunk.

By doing that, they can get a good estimate of your connections available bandwidth, which is needed for the decision whether to automatically switch to a higher/lower quality feed.

It also means they can use 'dumb' servers which don't do any application-specific logic for throttling.

Recently I've noticed my phone disconnecting from my Wi-Fi router (a relatively underpowered device running OpenWRT and WireGuard) when starting YouTube videos. I guess this could explain it, if the router is hiccuping on that initial blast of data. I also use a Safari extension that lets me choose the YouTube video quality, so that might affect it if I'm not giving the feedback they expect for "auto" quality selection.

(The issue is not the router, though - this doesn't happen on my laptop. I think my phone is just more aggressive in assuming the Wi-Fi is down and it's better to switch to cellular. But couple that with my phone's policy to use VPN on cellular, and the switch becomes much higher friction. I tried simply disabling cellular data, but then it's even worse because every time the phone disconnects from Wi-Fi it pops an alert telling me to enable cellular data.)

makes sense, but in that case it's quite easy to distinguish between a burst of traffic of <1s to a speedtest that last tens of seconds

Are you kidding?

Snooping like this is EXACTLY why we still have unencrypted ServerNameIndication, even to this day in ECH (which still leaves the outer SNI in the clear).

What does the outer SNI tell a hypothetical filtering/traffic shaping ISP that the IP address doesn't already?

lots of sites often just are connections to cloudflare/akami/fastly these days. Ie. one IP, millions of websites. The ISP/feds need SNI to tell what you're up to.

Yes, but the outer SNI (with ECH) in that case would just say "Cloudflare", "Akamai" etc., if I understand it correctly.