Implement Encrypted Client Hello (ECH)

[fabriziobagala]

I have checked if others have suggested this already

• I have checked this issue tracker to see if others have reported similar issues.

Feature description

ECH is an extension of the TLS protocol. It aims to secure the TLS handshake portion of the protocol by encrypting the name of the websites you visit, which is in plain-text. For more details, click TLS Encrypted Client Hello.

Alternative solutions

Currently the only solution is to disable the VPN and use a provider such as Cloudflare to get this protection.

Type of feature

• Better privacy/anonymity
• Better at circumventing censorship
• Easier to use
• Other

Operating System

• Android
• iOS
• Windows
• macOS
• Linux

[chaojoy]

Developers are strongly advised to pay attention to this issue. Even TLS1.3 will expose the server website domain name to be accessed when sending the client hello handshake data packet. This is a serious privacy threat in countries with strict network censorship and can be easily blocked by deep packet inspection systems.

[hulthe]

We are keeping an eye on this, but AFAICT we're still waiting on openssl.