ECH (Encrypted Client Hello)
TLS 1.3-extension som krypterar SNI-fältet (hostname) i ClientHello. Default ClientHello är plaintext → ISP/middleboxes ser visited-domains. ECH krypterar via HPKE → ISP ser bara IP-adress, ej domain.
Cloudflare deployed 2023. Firefox 118+ (sept 2023) enable-by-default när ECH-config tillgänglig via DNS. Privacy-vinst: combine ECH + DoH → ISP ser inget om actual destination (bara IP). Defeats SNI-based-censorship i many cases (China, Russia historically used SNI för domain-blocking). Adoption requires server-deployment (Cloudflare = most internet automatically) + browser-deployment (Firefox + Chrome). Counter-deployment: nations could block ECH-using TLS-handshakes — DPI-arms-race.