What is the difference between VPN and Domain fronting?

Question

What is Domain fronting? and how it is different from a VPN?

Answer 1

Domain fronting is a technique of exploiting HTTPS/TLS protocol specifics to obfuscate the actual server domain and avoid censorship. Essentially, domain fronting just hides the server's name that is exposed by SSL/TLS otherwise. The actual communication is encrypted anyway.

In one configuration, a large hosting service such as Amazon S3 or Google App Engine uses a shared SNI certificate containing both a common and target HTTPS domains. The domain name of the actual, blocked endpoint is only communicated after the establishment of an encrypted HTTPS connection, in the HTTP Host header, making it invisible to censors. This can be done if the blocked and the innocuous sites are both hosted by the same large provider, such as Google App Engine.

Other configurations allow a content delivery network's common HTTPS certificate and infrastructure to act as a reflector through to the target server behind.

These techniques work by using different domain names at different layers of communication. The domain name of an innocuous site is used to initialize the connection. This domain name is exposed to the censor in clear-text as part of the DNS request and the TLS Server Name Indication. For any given domain name, censors are typically unable to differentiate circumvention traffic from legitimate traffic. As such, they are forced to either allow all traffic to the domain name, including circumvention traffic, or block the domain name entirely, which may result in expensive collateral damage.

https://en.wikipedia.org/wiki/Domain_fronting

VPN is the use of an encrypted tunnel between two points on the Internet, forming a logical link. VPN encrypts everything running over the link, the only thing visible from the outside are the endpoints and the amount of traffic.

Both may be used for the same purpose - avoid Internet censorship - but they are completely different things.