ECH Without Padding Is a Lookup Table
by Danila Vershinin, September 10, 2026
ECH hides the SNI, yet every vhost we measured, 8 of 8 in the lab and 5 of 5 in production, was identifiable from server handshake record sizes alone. Here is the measured leak, and the one-directive NGINX module that closes it.
Read More...Encrypted Client Hello in NGINX: Now Shipping in Our RPMs and DEBs
by Danila Vershinin, August 25, 2026
Server-side ECH (RFC 9849) is live in our stock NGINX, NGINX-MOD and EDGE packages, on RPM and DEB alike, built on OpenSSL 3.5 LTS with the DEfO backport. Here is what it hides, what it does not, and how to run it with automatic key rotation.
Read More...Recommended Web Hosting
