But what's not encrypted by either is the Server Name Indicator or SNI, ie: the initial request to a webserver stating which host you're trying to reach at that IP, before establishing the TLS connection, contains the domain you'd requested via DoH/DoT, in plaintext.

[–] Album@lemmy.ca 3 points 6 months ago (1 children)

encrypted SNI is a thing now.

[–] Darkassassin07@lemmy.ca 4 points 6 months ago

True. Known as Encrypted Client Hello now, as part of TLS1.3.

It seems many more browsers support it than last I'd looked. I'm curious to see how much of the general web has adopted support for it onnthe server side. I'll have to look into that more, and see what it'll take to setup for self-hosting.

[–] WereCat@lemmy.world 1 points 6 months ago (1 children)

https://www.cloudflare.com/learning/dns/dns-over-tls/

If I understand it correctly DoH (which I use with NextDNS) should prevent ISP from snooping.

[–] Darkassassin07@lemmy.ca 1 points 6 months ago* (last edited 6 months ago)

It will prevent the ISP from snooping on, or tampering with, the DNS request. However when you go to use the IP you've retrieved via DoH/DoT; your first request establishing a TLS connection to that IP will contain an unencrypted SNI which states the domain you are trying to use. This can be snooped on by your ISP.

[–] ShortN0te@lemmy.ml 1 points 6 months ago

That is correct. HSTS helps to some degree but the very first request is still unprotected.