undefined | Better HN

0 pointsocdtrekkie26d ago0 comments

This will never happen. Because between enterprise networks and countries with laws, ECH will end up blocked a lot of places.

Big sites care about money more than your privacy, and forcing ECH is bad business.

And sure, kill SNI filtering, most places that block ECH will be happy to require DPI instead, while you're busy shooting yourself in the foot. I don't want to see all of the data you transmit to every web provider over my networks, but if you remove SNI, I really don't have another option.

0 comments

hypeatei26d ago

> Because between enterprise networks

> require DPI

Enterprises own the device that I'm connected to the network with, I don't see how you can get any more invasive than that.

> countries with laws

1) what countries do national-level SNI filtering, and 2) why are you using a hyptothetical authoritarian, privacy invading state actor as a good reason to keep plaintext SNI?

> Big sites care about money

Yes, and you could say that overbearing, antiquated network operators stop them from making more money with things like SNI filtering.

kelnos26d ago

> I don't want to see all of the data you transmit to every web provider over my networks

Then don't look. I'm serious. This idea that corporations need to snoop on everything their employees do is disgusting.

ocdtrekkieOP26d ago

So, if you are not at minimum inspecting SNI, you are not meaningfully providing security for your network. Where I work we do not really pay attention to what people are doing with their computers (that is an HR problem, not an IT problem), but the prevalence of ransomware almost certainly starts and ends with people not making rational network security decisions, which starts with filtering. We also remove the ads. =)

j / k navigate · click thread line to collapse