[dmitrygr]

> even HTTPS leaks the requested URL

It does not. In the olden days the host name was leaked, but with SNI even that is gone. Anything past the first "/" is never and was never sent in plaintext in HTTPS

[cperciva]

Most public web sites leak information about page accesses to anyone who can count bytes.

[teaearlgraycold]

What kind of attack are you describing?

[cperciva]

Count how many bytes of TCP traffic you see. Measure the size of each web page on the (public static) website.

[fmajid]

The host name is still leaked, SNI is not encrypted and ESNI is still not mandatory in TLS 1.3.

[2h]

> host name was leaked, but with SNI even that is gone

nope, you can still see it perfectly fine:

https://tlshello.agwa.name/

please don't spread misinformation.

[dmitrygr]

ESNI*

[2h]

OK, now name at least two public servers that use that. I will wait...