Hacker News Reader

> Why would I need a VPN for browsing if all my traffic is https and I use HTTPS DNS?

Until TLS 1.4 is deployed, each HTTPS-protected site you visit will still reveal the domain name in its certificate, giving your ISP a pretty good idea of your browsing patterns, which it will in turn sell or turn over to authorities when asked.

View on HN

TLS 1.3 already encrypts the full certificate. The only place where TLS 1.3 reveals the domain name is the SNI field, but there are ESNI proposals currently being worked on to fix this issue, although realistically, this will only work well with sites behind CDNs. If an IP hosts only a single site, and you connect to it, it will be possible to tell who you are connecting too.

Reply on news.ycombinator.com