Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Encrypted Client Hello

blog.cloudflare.com

Post reply on HN
Print view View original

21–30 of 219 posts

Re: Encrypted Client Hello

#21

Post by johnklos »

TrueDuality wrote: post #6
politelemon wrote: post #4

I'm not seeing it. It looks contradictory what they're saying. > This means that whenever a user visits a website on Cloudflare that has ECH enabled, no one except for the user and the website will be able to determine which website was visited. But if you look at the inner/outer SNI part: > The outer SNI is a common name that, in our case, represents that a user is trying to visit an encrypted website on Cloudflare.…

You're absolutely right, Cloudflare will still see it. That doesn't make this a bad improvement though. You don't have to use Cloudflare to support it, but it helps obscure which site is being visited by the nature of Cloudflare hosting so many different sites. So what does this actually protect against? Who will this benefit? Mostly people in censored countries and companies. This removes the last piece of informati…

I agree that this is generally a good thing, and that DoH is an absolutely shitty thing, but I think the poster here was taking exception to this statement:

"no one except for the user and the website will be able to determine which website was visited"

That, I think we can all agree, is patently untrue. Cloudflare shouldn't be publishing blatant deceptions.

Re: Encrypted Client Hello

#22

Post by johnklos »

kreetx wrote: post #13
TrueDuality wrote: post #6

Earlier quoted context omitted.

You're absolutely right, Cloudflare will still see it. That doesn't make this a bad improvement though. You don't have to use Cloudflare to support it, but it helps obscure which site is being visited by the nature of Cloudflare hosting so many different sites. So what does this actually protect against? Who will this benefit? Mostly people in censored countries and companies. This removes the last piece of informati…

What is wrong with DoH?

It takes our control over our networks away from us and gives it to random applications, to Trojans, to viruses, to adware purveyors, to advertisers.

It makes the assertion that because SOME of us don't know how to change our DNS servers, they (Mozilla, Cloudflare, other proponents of DoH) need to take control away from us and need to send our DNS lookups to, usually, them.

The justifications are ridiculous, but the harms introduced by DoH are much, much worse than the thing they're trying to say makes DoH useful.

Re: Encrypted Client Hello

#23

Post by jacooper »

politelemon wrote: post #4

I'm not seeing it. It looks contradictory what they're saying. > This means that whenever a user visits a website on Cloudflare that has ECH enabled, no one except for the user and the website will be able to determine which website was visited. But if you look at the inner/outer SNI part: > The outer SNI is a common name that, in our case, represents that a user is trying to visit an encrypted website on Cloudflare.…

Generally cloudflare assumes itself as being a part of the website. Its not the fiest time they did this.

Re: Encrypted Client Hello

#24

Post by dilyevsky »

makeworld wrote: post #2

If I host my website on a VPS, is ECH possible? Seems like it's only useful when IP addresses are shared across a bunch of sites.

Yes, but if you use dedicated IP it is kind of like pointless. If you use shared IP of your VPS provider (or Cloudflare) then yes fr

Re: Encrypted Client Hello

#25

Post by supriyo-biswas »

I see a lot of confusion here, probably Cloudflare should have included an explanation of how ECH works in TFA instead of referring to their other article[1].

The difference between ECH and SNI is that while SNI includes the hostname in the ClientHello (the first TLS record indicating connection initiation), ECH includes an encrypted section in the ClientHello called ClientHelloInner, and the hostname is moved inside it.

The ClientHelloInner is encrypted using a public key made available over DNS, which is queried over DNS over HTTPS providers such as Google or Cloudflare DNS; plaintext DNS is avoided in order to prevent a MITM on the ClientHelloInner key.

Doing so prevents ISPs and governments from analyzing your traffic. However, a CDN operator such as Cloudflare terminates TLS for your website, and thus traffic would be visible to them either way.

Now, to the non-technical part of it: while ECH provides a significant privacy improvement, I personally am against its implementation. Most ISPs enforce country-specific orders to block domains using a combination of DNS packet interception and SNI inspection. The legitimacy or sanity of such laws are a separate matter - countries would want to block websites that violate their laws.

If we take away this last resort from governments, they would react by enforcing client side blocklisting and DRMization as suggested in France[2], or force root certificate installation using legislation[3], or blocking large swathes of the internet as is the case with China.

[1] https://blog.cloudflare.com/encrypted-client-hello/

[2] https://www.article19.org/resources/france-proposed-internet...

[3] https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_a...

Re: Encrypted Client Hello

#26

Post by josephcsible »

politelemon wrote: post #4

I'm not seeing it. It looks contradictory what they're saying. > This means that whenever a user visits a website on Cloudflare that has ECH enabled, no one except for the user and the website will be able to determine which website was visited. But if you look at the inner/outer SNI part: > The outer SNI is a common name that, in our case, represents that a user is trying to visit an encrypted website on Cloudflare.…

When you visit a site on Cloudflare today, both Cloudflare and your ISP see the domain name. With ECH, only Cloudflare will.

Re: Encrypted Client Hello

#27

Post by josephcsible »

vasachi wrote: post #10
TrueDuality wrote: post #6

Earlier quoted context omitted.

You're absolutely right, Cloudflare will still see it. That doesn't make this a bad improvement though. You don't have to use Cloudflare to support it, but it helps obscure which site is being visited by the nature of Cloudflare hosting so many different sites. So what does this actually protect against? Who will this benefit? Mostly people in censored countries and companies. This removes the last piece of informati…

> This removes the last piece of information that can be used to block HTTPS traffic based on the site your visiting without being a party to the exchange. And that will cause blocks by IP. It's not like authorities in those countries care that much if a user can't access a not-blocked site, as long as they can't access a blocked one.

The point of efforts like this is exactly to make selective blocking infeasible. This will force the bad guys to choose between blocking nothing and blocking everything, and with the exception of North Korea, most aren't willing to do the latter.

Re: Encrypted Client Hello

#29

Post by josephcsible »

johnklos wrote: post #22
kreetx wrote: post #13

Earlier quoted context omitted.

What is wrong with DoH?

It takes our control over our networks away from us and gives it to random applications, to Trojans, to viruses, to adware purveyors, to advertisers. It makes the assertion that because SOME of us don't know how to change our DNS servers, they (Mozilla, Cloudflare, other proponents of DoH) need to take control away from us and need to send our DNS lookups to, usually, them. The justifications are ridiculous, but the…

> It takes our control over our networks away from us

Taking control away from the owner of networks is a good thing. Control is supposed to reside with the owner of endpoints. To see why, imagine if your ISP started to MITM all of your connections that went over their network.

> don't know how to change our DNS servers

It's not a case of "don't know how". It's a case of "can't, because even if you change the setting, $evil_isp will hijack the queries anyway".

Re: Encrypted Client Hello

#30

Post by josephcsible »

ploum wrote: post #3

If I understand this right, it is basically "cloudfare will appear like a huge web server for anybody watching". This looks like one more attempt by cloudfare to recentralize the web. And it doesn’t address the issue that cloudfare still perfectly know which website you are visiting. Did I miss something?

It's not making the Web any more centralized. It's a silver lining we get due to how centralized it already is.
Post reply on HN