Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I know that even with DoT or DoH the target of the connection is leaked due to the use of SNI in the client hello (and that ESNI/ECH are proposed solutions), but what I can't figure out is does SNI get used 100% of the time (assuming a TLS connection)?
If it's not 100% of the time, then when does it or doesn't it get used?
By "used" I mean is it always present in the client hello making TLS connections ALWAYS leak their target
Using SNI extension or not depends on the TLS client. Some will use it by default (e.g. all major browsers?), some won't use it at all (e.g. all IE versions on Windows XP), while some other clients will use it or not depending on params/configuration (see e.g. openssl s_client with options -servername and -noservername).
There may be a way to disable SNI in your browser settings. This would stop your browser from sending SNI information in the client hello when you connect to a site by https.
But, this will also mean:
If a server is hosting multiple TLS sites on the same IP, your browser will not be able to connect to any of these sites (This is exactly why we have SNI - so that a server can host multiple TLS sites on the same IP).
If a server is hosting just a single TLS site on the IP, then your browser will be able to connect to it by https. But, any eavesdropper will know you are connecting to the site, because it's the only site on that IP.
So, disabling SNI in your browser (if it's even possible) would probably prevent you from connecting to a lot of sites, and will still leak the sites that you are still able to connect to.
