The point OP is making is not everything requires privacy. We shouldn't pay the (higher and higher) price of keeping privacy for cases where it's just not needed.
But what URLs people visit are very much private information for example.
Also one of the ideas in general is, to obfuscate the really private communication by burying them in a sea of also encrypted, but trivial data.
If only the very sensitive informations get encrypted, then this is also a very good filter for an attacker to ignore everything else and just go for the high protected ones.
I was reading up on how this worked. It’s a really good idea, and a step in the right direction 100%… cloudflare is flexing a little and this mainly works because so many people are on cloudflare.
It never ceases to amaze me how complicated privacy is.
From cloudflares blog [1]
“ What about the IP address?
While both DNS queries and the TLS SNI extensions can now be protected by on-path attackers, it might still be possible to determine which websites users are visiting by simply looking at the destination IP addresses on the traffic originating from users’ devices. Some of our customers are protected by this to a certain degree thanks to the fact that many Cloudflare domains share the same sets of addresses, but this is not enough and more work is required to protect end users to a larger degree. Stay tuned for more updates from Cloudflare on the subject in the future”
