ESNI (Encrypted Server Network Identification) with HTTP CONNECT (HTTP Proxy)

Question

Regarding ESNI RFC (https://tools.ietf.org/html/draft-ietf-tls-esni-02) it copes with many possible security vulnerabilities. However I'm interested how is it supposed to prevent confidential information leakage (SNI) in case of HTTP Proxy is used (or forced to be used)?

HTTP CONNECT request sends domain's FQDN in plaintext before any connection is tunneled.

I know proxy is another layer not so related to ESNI itself but I think it should be considered as a possible weakness.

Am I missing something here?

(btw please someone add new tags "esni", "sni" and "tls-1.3" to this question - don't have reputation for that, thanks)

Answer 1

The goal of ESNI is deny observability of the target domain when only passive sniffing of the traffic is done. This targets primarily deep packet inspection at the level of ISP which might like to create profiles of users or restrict/shape some traffic to some targets for their own gain or because laws require it.

This does not prevent the visibility of the target domain in the CONNECT request. But a CONNECT request is only issued by the browser if a proxy is explicitly configured in the browser. This need to be done by a person controlling the computer and is often pushed via company wide policies. Explicit proxies are usually used only within the company (or home) network - which means out of reach of the ISP. And traffic visibility and regulation inside these privately owned networks is commonly (more or less) accepted as necessity.