Domain Fronting is Dead, Long Live Domain Fronting: Using TLS 1.3
Erik Hunstad resurrects domain fronting using TLS 1.3 Encrypted Server Name Indication (ESNI/ECH), bypassing modern network censorship and deep packet inspection.
Summary
The Demise of Classic Domain Fronting
Domain fronting allowed circumvention tools and red teams to conceal HTTPS destinations by mismatched HTTP Host headers, until major CDN providers disabled the technique in 2018.
Enter TLS 1.3 and Encrypted SNI (ESNI)
Erik Hunstad introduces next-generation domain fronting leveraging TLS 1.3 and Encrypted Server Name Indication (ESNI/ECH) to encrypt the TLS handshake SNI extension.
Fooling Modern Deep Packet Inspection Engines
By decoupling public DNS records, frontend CDN endpoints, and encrypted backend server names, traffic appears completely indistinguishable from benign HTTPS traffic.
Tool Release and Circumvention Strategies
Hunstad releases proof-of-concept tooling, demonstrating how human rights activists and privacy tools can maintain resilient connectivity across censored networks.
Related talks
Main Stage·30 min
Erik Hunstad
Erik Hunstad answers questions on TLS 1.3 Encrypted Client Hello, CDN domain fronting circumvention, and DPI evasion.
Main Stage·42 min
Roger Dingledine
Tor Project co-founder presents the ongoing arms race between Tor's traffic obfuscation and state-level deep packet inspection censorship systems.
Main Stage·34 min
Alex
Meduza CTO Alex details the technical infrastructure and circumvention engineering used to bypass Russian internet censorship and deliver unbiased news to millions.