@rikudou @voxel
ASFAIR it used to be even worse than that, because if you didn’t want SNI (for compatibility reasons or whatever), but you still wanted a certificate, you had to have one server for every hostname (because each had its own IP), assuming you could afford the additional IP space

Granted you didn’t need a physical server, but that was still a bigger cost

Some servers are more flexible on that front, but early SNI didn’t have those

@rikudou @voxel
Wasn’t SNI happening after the handshake? Or is this completely what ECH is about.

RIP Windows XP

An IP address is no longer associated with just one website/domain name. There could be thousands of websites running on a single IP address.

As is, anyone can currently look at your encrypted traffic and see in plain text which site you're surfing to. So this proposal is long overdue.

somebody wiresharking your traffic can see the domain name you're contacting even if you use https; this solves that.

reverse DNS lookup does exist, but it's not always accurate, especially when multiple websites are hosted on the same server (which is more common than you think)

Technically DNS will let you look up a host name from an IP address, but the catch is that it might not work: it's not automatically configured. And even if it is configured you might not get all of the host names pointing at that address.

Very many webserver operators don't bother adding the server's host name to reverse DNS. For example, lemmy.world's IP address does not map to any host name in reverse DNS, and google.com's IP address maps to some completely different name for me, with no mention of Google in the returned name.

Also, many websites can be served from the same IP address, especially if they are hosted in the cloud. You are correct that someone snooping on the connection would still see the IP address, but if that points them at something like a webhosting company or a CDN (or some other server hosting many different sites) it still doesn't really tell them which specific site is being accessed.

But yes, if the site you're accessing is the only one hosted on that server then the snoop could potentially guess the host name. But even then: how would they know that's the only site hosted there? If some site they've never even heard of uses the same IP address they would never know.

You need to read how SNI works, then it will make sense

You can always set up a MITM on your network. But yeah, DNS filtering is doomed in the not so far future.

Encrypted DNS has been possible and in use for years (including looking up IP addresses over HTTP, which I've caught several apps doing), but this isn't DNS related.

SNI filtering was pretty popular back in the day, but domain fronting is trivial to set up outside the browser. No SNI filtering setups I've come across actually bother to check certificate validity, so generating a self-signed eff.org certificate and using that from within an app would make quick work of most network filters.

I'm afraid firewalls are the only workable solution if you're not in control of the software you're running. You can try to force apps through a MitM setup by blocking all outgoing traffic and configuring something like Privoxy as the only way out, but getting your MitM CA loaded into these apps can be a royal pain.

You can do filtering and monitoring in the DNS server itself in corpo environment, like umbrella or AD DNS.

DNS of HTTPS or TLS has been available for years, but it hasn't been adopted widely because the hello at the beginning if the three way handshake when connecting to a website ratted you out to your ISP anyways.