logoalt Hacker News

1vuio0pswjnm7yesterday at 6:52 PM0 repliesview on HN

China and Russia started to block ESNI before Cloudflare stopped offering it so any argument that ESNI did not work is dubious

IME, ESNI worked for accessing _all_ websites using CF. AFAIK, ECH has never been offered for all websites using CF

ESNI was a bit simpler to use than ECH, e.g., when making HTTP requests with programs like openssl s_client, bssl client, etc. (I don't use popular browsers to make HTTP requests)

When CF ended the ESNI trial, there was nothing to take its place. The public was asked to wait for ECH

It has been roughly five years (correct me if wrong) without any replacement solution for plaintext SNI

ECH is available on a few test sites, e.g.,

https://test.defo.ie

But software support for ECH makes little practical difference for www users if major CDNs still don't support it

And as far as a solution that applies to CDNs other than CF, there has been no solution at all

Plaintext SNI is everywhere. It more or less defeats the stated purpose of "encrypted DNS"