  In this paper, we revisit the performance of the QUIC connection setup and
relate the design choices for fast and secure connections to common Web
deployments. We analyze over 1M Web domains with 272k QUIC-enabled services and
find two worrying results. First, current practices of creating, providing, and
fetching Web certificates undermine reduced round trip times during the
connection setup since sizes of 35% of server certificates exceed the
amplification limit. Second, non-standard server implementations lead to larger
amplification factors than QUIC permits, which increase even further in IP
spoofing scenarios. We present guidance for all involved stakeholders to
improve the situation.
