grapheneosfan2 It won't help for our services because we have a small set of known IP addresses which can be blocked much more easily than filtering TLS traffic with the domains in SNI.
[deleted] It will still be clearly known which servers are being connected to because they ONLY host GrapheneOS services. Our servers are not used to host both GrapheneOS services and services for other things.
ECH will not actually accomplish anything in this case. ECH can be very useful more generally and it's worth doing. It's implemented for Chromium and therefore Vanadium.
de0u There are 4 separate servers for our network services and 8 separate servers for our update servers. They're publicly known, easily identified IP addresses. ECH cannot hide that they're GrapheneOS services. It's easier to identify them by their IP addresses than the SNI server name in the TLS ClientHello. There's no actual value in trying to hide this in this case. ECH is useful in general because this traffic might as well be encrypted and it ever so slightly reduces the metadata that's exposed. In some cases, it masks which service is being used in a useful way when there are multiple uses for an IP address in a way that matters. This is really not the case here, where knowing which name is being used doesn't have more value than the IP address. Every name that's provided by these services is used by each GrapheneOS device. The ones for PSDS and SUPL are only used when using location detection and so on, which doesn't leak any useful information in this case.
ECH will eventually be available beyond Vanadium, but it does not make sense for us to accelerate that. Current server software also doesn't support it. It's currently mostly only implemented by a few large providers like Cloudflare in proprietary software. OpenSSL doesn't support it and neither does nginx. It would require using BoringSSL with a fork of nginx, along with making substantial changes on the client side which would add attack surface, complexity and take significant effort away from useful privacy work instead of doing something that's not truly useful in practice.