ECH (Encrypted Client Hello)
TLS 1.3 extension that encrypts the SNI field (hostname) in ClientHello. Default ClientHello is plaintext → ISP/middleboxes see visited domains. ECH encrypts via HPKE → ISP sees only the IP address, not the domain.
Cloudflare deployed 2023. Firefox 118+ (Sept 2023) enable-by-default when an ECH config is available via DNS. Privacy gain: combine ECH + DoH → ISP sees nothing about the actual destination (only IP). Defeats SNI-based censorship in many cases (China, Russia historically used SNI for domain blocking). Adoption requires server deployment (Cloudflare = most of the internet automatically) + browser deployment (Firefox + Chrome). Counter-deployment: nations could block ECH-using TLS handshakes — DPI arms race.