Gemini requires SNI. Major design flaw, IMO. It should be optional. AFAIK there are no gemini sites that support TLS1.3 with ESNI/ECH.^1 That means every hostname gets sent in plaintext over the wire. No exceptions. (Not every site owner is going to do virtual hosting, yet every client request must send SNI anyway. That is dumb.)
Tracking a user's complete browsing history would seem quite easy unless sites add padding to disguise file sizes.
At least with HTTP, most Cloudlfare-hosted sites will support ESNI. Plus there are some other workarounds to avoid SNI on other sites. Better than nothing.
1. Putting an ECH-enabled proxy in front of gemini servers may be one solution. https://defo.ie
Tracking a user's complete browsing history would seem quite easy unless sites add padding to disguise file sizes.
At least with HTTP, most Cloudlfare-hosted sites will support ESNI. Plus there are some other workarounds to avoid SNI on other sites. Better than nothing.
1. Putting an ECH-enabled proxy in front of gemini servers may be one solution. https://defo.ie