Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Encrypted Client Hello

blog.cloudflare.com

Post reply on HN
Print view View original

111–120 of 219 posts

Re: Encrypted Client Hello

#111

Post by josephcsible »

AnthonyMouse wrote: post #71
WorldMaker wrote: post #52

Earlier quoted context omitted.

> People own their networks when they're not out in public. People rent their networks from one, maybe two area options. The consumer networks want to completely control router hardware these days and these days charge extra rental fees for owned hardware instead of rented hardware. (It's fascinating that they can legally get away with that.) Some of the biggest consumer networks have already proven they are happy to…

> People rent their networks from one, maybe two area options. That's not the LAN. > The consumer networks want to completely control router hardware these days and these days charge extra rental fees for owned hardware instead of rented hardware. (It's fascinating that they can legally get away with that.) You can put your own router behind theirs. It's ridiculous for them to make you do that but nothing actually st…

> That's not the LAN.

It doesn't matter much that your LAN itself is trustworthy if the only way out of it isn't.

> You can put your own router behind theirs. It's ridiculous for them to make you do that but nothing actually stops you.

Yes, you can do that, but it doesn't do anything to help with the problem that DoH solves.

> For which anyone can use a VPN.

I want to live in a world in which you can have privacy without having to be on a VPN 24/7.

> To work around this, a piece of malware would have to contact some custom server on a different port to do a name lookup -- but where does it look up that server's IP address? Hard-coding the IP address allows the malware's lookup server to be blocked.

Couldn't it host a file with the IP on a service like Dropbox or GitHub Pages? People aren't likely to block them at the firewall.

> But if centralized DoH servers become too popular to block because blocking them breaks too many legitimate applications, now the malware can use them and the user can't block them.

Isn't this basically "privacy for computer programs is bad because malware benefits from it", which is wrong for the same reason that "privacy for people is bad because criminals benefit from it"?

> The question is, what are they doing with the data they collect?

What's your ISP doing with all of the data they collect from your insecure DNS queries? And if you're concerned about Cloudflare in particular, then just use some other DoH provider.

> There is already a "least wrong" answer: Use a VPN you trust and use your VPN's DNS or run your own. VPNs have plenty of competition, and you can set up your own on any hosting provider, which also have plenty of competition.

> This is basically the same thing as having Cloudflare do it over TLS, except that it's not centralized and remains in the control of the user, so is better.

Cloudflare doesn't have a monopoly on DoH. There's plenty of competition between providers for it too: https://github.com/curl/curl/wiki/DNS-over-HTTPS#publicly-av...

Re: Encrypted Client Hello

#112

Post by josephcsible »

ceilingcat0 wrote: post #110
supriyo-biswas wrote: post #25

I see a lot of confusion here, probably Cloudflare should have included an explanation of how ECH works in TFA instead of referring to their other article[1]. The difference between ECH and SNI is that while SNI includes the hostname in the ClientHello (the first TLS record indicating connection initiation), ECH includes an encrypted section in the ClientHello called ClientHelloInner, and the hostname is moved inside…

They're going to resort to blocking IPs and not caring about collateral damage and force CDNs and anyone running multi tenant to turn the specific site targeted off or move them onto a separate pool of IPs that is easily blockable.

The hope is that the CDNs explicitly refuse to do that, so that the collateral damage leads to pressure that forces the censor to relent.

Re: Encrypted Client Hello

#113

Post by josephcsible »

xg15 wrote: post #103
supriyo-biswas wrote: post #25

I see a lot of confusion here, probably Cloudflare should have included an explanation of how ECH works in TFA instead of referring to their other article[1]. The difference between ECH and SNI is that while SNI includes the hostname in the ClientHello (the first TLS record indicating connection initiation), ECH includes an encrypted section in the ClientHello called ClientHelloInner, and the hostname is moved inside…

> Now, to the non-technical part of it: while ECH provides a significant privacy improvement, I personally am against its implementation. Most ISPs enforce country-specific orders to block domains using a combination of DNS packet interception and SNI inspection. The legitimacy or sanity of such laws are a separate matter - countries would want to block websites that violate their laws. You don't even have to start w…

No it can't. If it's in a browser, then extensions can still block it, and if it's in an app, then they could make it unblockable without needing DoH or ECH just by putting the trackers/ads/app telemetry on the same domain as the rest of what the app uses.

Re: Encrypted Client Hello

#115

Post by josephcsible »

4death4 wrote: post #107
josephcsible wrote: post #105

Earlier quoted context omitted.

> I expect any sane network to do the same. Why? Sane networks shouldn't block anything. Even super dangerous stuff like ports 135-139 and 445 are a morally gray area. > The idea of uninspectable client traffic is somewhat unhinged, and is already heavily used by malicious actors. How is privacy unhinged? Isn't that basically the same as the argument that we need to gut the Fourth Amendment because of terrorists and…

I don’t think morals factor in to the decision to allow / disallow traffic on a private network. That’s definitely morally neutral and to suggest otherwise is immoral.

I didn't mean private networks. I meant the ISPs that do that.

Re: Encrypted Client Hello

#116

Post by ocdtrekkie »

josephcsible wrote: post #115
4death4 wrote: post #107

Earlier quoted context omitted.

I don’t think morals factor in to the decision to allow / disallow traffic on a private network. That’s definitely morally neutral and to suggest otherwise is immoral.

I didn't mean private networks. I meant the ISPs that do that.

ISPs are also private networks, unless operated by a government entity. And I would absolutely uphold the same expectation from an ISP as an organizational or personal network.

Re: Encrypted Client Hello

#117

Post by josephcsible »

ocdtrekkie wrote: post #109
josephcsible wrote: post #105

Earlier quoted context omitted.

> I expect any sane network to do the same. Why? Sane networks shouldn't block anything. Even super dangerous stuff like ports 135-139 and 445 are a morally gray area. > The idea of uninspectable client traffic is somewhat unhinged, and is already heavily used by malicious actors. How is privacy unhinged? Isn't that basically the same as the argument that we need to gut the Fourth Amendment because of terrorists and…

[flagged]

By that logic, wouldn't every ISP have a moral obligation to MITM all of their customers' traffic? Obviously that's wrong.

Re: Encrypted Client Hello

#118

Post by ocdtrekkie »

josephcsible wrote: post #117
ocdtrekkie wrote: post #109

Earlier quoted context omitted.

[flagged]

By that logic, wouldn't every ISP have a moral obligation to MITM all of their customers' traffic? Obviously that's wrong.

SNI monitoring is a reasonable compromise, and I think a healthy one: Your ISP doesn't need to deep inspect your traffic to Microsoft because it accepts that Microsoft is doing something reasonable with it. It allows delegating authority which at least gives a path for investigation or blocking if necessary without seeking an extreme amount of transient information.

I would say if ECH is implemented the correct response would unfortunately be to MITM it if too many providers implement it to just block it entirely. I suspect large companies won't force it to maintain a wide customer base, and again, any reasonable network operator should just block anyone who does.

ISPs absolutely have all sorts of regulatory needs and network performance reasons to classify traffic. It's an unpopular view, but it's reality. (And I would encourage you to investigate who pays the people telling you otherwise, before someone links Mike Masnick here.)

Re: Encrypted Client Hello

#119

Post by [deleted] »

ocdtrekkie wrote: post #100
josephcsible wrote: post #50

Earlier quoted context omitted.

> while ECH provides a significant privacy improvement, I personally am against its implementation. Most ISPs enforce country-specific orders to block domains using a combination of DNS packet interception and SNI inspection. The legitimacy or sanity of such laws are a separate matter - countries would want to block websites that violate their laws. That's exactly why I'm in favor of it: it makes effective censorship…

We will almost certainly block ECH at my work, as we already block DoH. I expect any sane network to do the same. The natural alternative if blocking these protocols becomes unsustainable will absolutely be to require full decryption at our security edge. And that will provide drastically more information to us than we have now and will absolutely feel invasive. The idea of uninspectable client traffic is somewhat un…

[deleted]

Re: Encrypted Client Hello

#120

Post by costco »

supriyo-biswas wrote: post #25

I see a lot of confusion here, probably Cloudflare should have included an explanation of how ECH works in TFA instead of referring to their other article[1]. The difference between ECH and SNI is that while SNI includes the hostname in the ClientHello (the first TLS record indicating connection initiation), ECH includes an encrypted section in the ClientHello called ClientHelloInner, and the hostname is moved inside…

> If we take away this last resort from governments, they would react by enforcing client side blocklisting and DRMization as suggested in France[2], or force root certificate installation using legislation[3], or blocking large swathes of the internet as is the case with China.

Not every government has the leverage, capability or power to do this. Client side blacklisting will be trivially circumvented if it actually goes into effect. The browser vendors all rejected the proposed Kazakh root certificate. And plenty of countries with pervasive Internet censorship don't have enough of a "domestic internet" to block large numbers of websites without a lot of people getting upset.

Post reply on HN