image credit: pixabay
In 2018, just after Cloudflare turned on Encrypted SNI, Mozilla added support for encrypting the Transport Layer Security (TLS) SNI extension to Firefox Nightly.
While aiming to better protect against eavesdropping, SNI was found to leak the identity of visited websites during the initial TLS handshake. An extension to TLS 1.3 and above, ESNI was meant to address the data leakage through replacing the SNI extension in Client Hello with an encrypted variant. Client Hello is the first message exchanged in the TLS handshake process.
Only encrypting the SNI extension, however, was found to deliver incomplete protection, while ESNI’s use in the real-world was deemed challenging from both interoperability and deployment perspectives, thus preventing it from being widely adopted.
