Hacker News Reader

Modern TLS is enough to prevent others from eavesdropping everything except domain names when on public WiFi. Domain names are sent in clear text if your client supports SNI.

View on HN

A trail of DNS names is more than enough to know what somebody is up to.

You could use DoH, which you should do anyway. No reason to leak DNS lookups to anyone.

DoH alone is not enough due to https://en.wikipedia.org/wiki/Server_Name_Indication being sent in plain text. Some day ECH (formerly, eSNI) should help with that.

I thought TLSv1.3 already encrypted the SNI?

It does

ESNI is not implemented yet on any website. And there is no software support except beta versions of Chrome/Edge and you have to manually toggle flags in dev mode.

All SNIs are passed as plain text to your ISP/VPN, even with DoH/TLS secure DNS enabled.

No. ESNI is an later-created extension to TLS 1.3

you'll always be leaking it to whoever you are sending your query to.

Reply on news.ycombinator.com