[iso1210]

We have SNI. Now sure your therapist may run their own VM on it's own IP address, but that's not very likely.

[mumblemumble]

SNI doesn't encrypt the desired hostname in the payload of the initial connection. It's still plainly visible to an eavesdropper. They can also observe un-encrypted DNS lookups.

[skissane]

eSNI is going to fix that

https://tools.ietf.org/html/draft-ietf-tls-esni-07