komuw
commented
9 months ago Just to clarify, ECH is the last part of the solution. There were four places where website names
were leaking in plaintext:
In the TLS Server Certificate (fixed by TLS 1.3)
In the DNS lookup (fixed by DNS-over-HTTPS - which has already shipped in Firefox)
In the certificate revocation checking (fixed by OCSP Stapling and CRLite)
In the SNI field (fixed by ECH).
On the topic of IPs, they are far less unique than people realise. Cloudflare have already
experimented with serving all of their websites from a single IP address [1].
In their measurement study, over 50% of the entire .com, .net, .info and .org namespace
(255 million websites) is available from only ~100 IPs.
This is obviously not great from a centralisation perspective,
but that seems like more a reason for Caddy to support privacy features like ECH, not less!from https://github.com/caddyserver/caddy/issues/4221#issuecomment-1746811801
Support Encrypted Client Hello(ECH).