Good-bye ESNI, hello ECH

If you want to play around with it:

Chromium: Enable #encrypted-client-hello and #dns-https-svcb

Firefox: Enable network.dns.echconfig.enabled

What's strange is that even with these enabled, Cloudflare's tester still reports ECH is not enabled [1] while Chromium's reports it is [1]. Maybe Cloudflare's tester is not using the latest spec?

[0] https://www.cloudflare.com/ssl/encrypted-sni

[1] https://tls-ech.dev

Cloudflare's introduction to encrypted client hello, a way to keep the server you're connecting to encrypted.

Be keen to see what the HN crowd makes of it.