Domain-Based Filtering

A fifteen-line listener reads your destination out of TLS without decrypting a byte

A developer dumped the ClientHello that openssl sends and found the requested hostname in plain ASCII inside the server_name extension. A listener holding no private key read it back off the wire, TLS 1.3 included.