You’re absolutely right: adblockers (even via pi-hole) will be ineffective.
Not mentioned in this article, but ECH lays the foundation for each application to decide if they trust the upstream DNS provider or not.
Normally, an app trusts all pre-installed CAs. If any of these CAs were to issue a fraudulent certificate, the app would be at risk from an on-path attacker. Some apps choose to limit the set of certificates they accept by either limiting the set of CAs they trust or by certificate pinning.
You’re absolutely right: adblockers (even via pi-hole) will be ineffective.
Not mentioned in this article, but ECH lays the foundation for each application to decide if they trust the upstream DNS provider or not.
Source
So using custom DNS to block/prevent unwanted updates and to block ads will be a thing of the past.
…but this does mean if your ISP or country is censoring the internet: their job has gotten much more difficult.
I disagree.
CA pinning has nothing to do with DNS.
CA pinning makes it harder to inspect the content of the connection e.g. via a Man-in-the-middle attack. But DNS-based blocking is not affected.
ECH has nothing to do with DNS.
DNS and DNS adblockers come before the ClientHello.
ECH is meant to make the wanted virtual host known without sending it as plaintext in the ClientHello.
Please refrain from commenting again.