Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Encrypted Client Hello

blog.cloudflare.com

Post reply on HN
Print view View original

201–210 of 219 posts

Re: Encrypted Client Hello

#201

Post by 8n4vidtmkvmk »

eddythompson80 wrote: post #163
EVa5I7bHFq9mnYK wrote: post #157

Earlier quoted context omitted.

"Malicious actors" are employees trying to visit instagram from work, right?

I think they mean malware. Ransomware for example. Nothing wrong about locking a network down in general. Work network doesn’t have to be an open, all things go, network just so employees can instagram. Heck, there are organizations with air-gaped networks for very good reasons. Instagram on your phone while at work. Don’t expect privacy on managed work machines. You company can see your emails. They can install CA o…

I'll be worried when I hear the first case of an employee getting in trouble for doing something innocent on corpnet. Right now I assume they can see everything while using one of their devices or on their network but they never bug us about it. They seem mostly interested in stopping malware/leaks, which seems quite reasonable.

Re: Encrypted Client Hello

#202

Post by YeBanKo »

d-z-m wrote: post #177
YeBanKo wrote: post #151

Earlier quoted context omitted.

DNS don’t serve regular web traffic, so all the request to DNS server can be classified as DNS request. So what does it add on top of DoT?

It's harder to block.

You can run DoT on any port, including 443. Then blocking it gonna be the same as blocking DoH. Why wrap it into HTTP request layer?

Re: Encrypted Client Hello

#203

Post by unaindz »

josephcsible wrote: post #87
YeBanKo wrote: post #72

Earlier quoted context omitted.

> I still think DoH is hot garbage and the way it has been implemented across browsers is an atrocity. Not sure if it's a hot garbage, but I don't see why it's better than DoT or DoQ, except maybe a use case for censored countries. DoT is faster and can be abstracted away from from HTTP. Presumably, DoH is more privacy preserving, because it runs on the same port and looks just like the rest HTTPS traffic. But I thin…

> I don't see why it's better than DoT or DoQ, except maybe a use case for censored countries. This feels like saying "I don't see why we need oxygen in the atmosphere, except for people needing to breathe." Being able to overcome censorship is a huge win and is more than sufficient for DoH to be better than DoT, etc. > Also, we are moving from your ISP knowing too much about you to Cloudflare knowing too much about…

And cloudflare already knew what site you were visiting. It's not like they only know it if you use ECH.

Re: Encrypted Client Hello

#204

Post by jacooper »

Groxx wrote: post #142
ignoramous wrote: post #124

Earlier quoted context omitted.

> plaintext DNS is avoided in order to prevent a MITM on the ClientHelloInner key. Is MiTM possible unless the attacker is in possession of a sufficiently advanced quantum computer? What's published as HTTPS/SVCB record is the public part of the key. Afaik, DNSSEC isn't even a requirement for zones publishing HTTPS/SVCB ECH records? > Doing so prevents ISPs and governments from analyzing your traffic . Don't think tr…

I think the remark is because: MITM would allow them to spoof the DNS response entirely, so they can replace it with whatever key they want. Doesn't matter what level of security the key claims at that point, it's attacker-controlled and they can just read whatever you send next.

This wouldn't be possible with dnssec right?

Re: Encrypted Client Hello

#205

Post by EVa5I7bHFq9mnYK »

eddythompson80 wrote: post #163
EVa5I7bHFq9mnYK wrote: post #157

Earlier quoted context omitted.

"Malicious actors" are employees trying to visit instagram from work, right?

I think they mean malware. Ransomware for example. Nothing wrong about locking a network down in general. Work network doesn’t have to be an open, all things go, network just so employees can instagram. Heck, there are organizations with air-gaped networks for very good reasons. Instagram on your phone while at work. Don’t expect privacy on managed work machines. You company can see your emails. They can install CA o…

MITM can't prevent leakage for a determined spy or insider trader. I worked at a bank, they blocked FB etc with a blacklist, but it was very easy to circumvent. Whitelist might work, but it would create too much management headache.

Re: Encrypted Client Hello

#207

Post by tatersolid »

YeBanKo wrote: post #153
tialaramex wrote: post #79

Earlier quoted context omitted.

Deployability is what matters. DoH had great deployability because everybody speaks HTTPS. In my home, lots of technologies would work. I have static v4 and v6, I have complete control over the firewalls, I can do whatever I want. But at my mum's house, who knows what ports work and which protocols work over them and whether you can change any of that. HTTPS definitely works though, because if it didn't her web brows…

Everybody who speaks HTTPS speaks TLS and the existing DNS-over-TCP. DoT is just DNS-over-TCP tunneled inside TLS. And it can be on any port, not necessarily 853, could be even on 443. What is the point of wrapping it into http request?

Because ports other than 443 are often blocked on corporate, hotel, and even coffee shop networks.

Re: Encrypted Client Hello

#208

Post by ocdtrekkie »

8n4vidtmkvmk wrote: post #201
eddythompson80 wrote: post #163

Earlier quoted context omitted.

I think they mean malware. Ransomware for example. Nothing wrong about locking a network down in general. Work network doesn’t have to be an open, all things go, network just so employees can instagram. Heck, there are organizations with air-gaped networks for very good reasons. Instagram on your phone while at work. Don’t expect privacy on managed work machines. You company can see your emails. They can install CA o…

I'll be worried when I hear the first case of an employee getting in trouble for doing something innocent on corpnet. Right now I assume they can see everything while using one of their devices or on their network but they never bug us about it. They seem mostly interested in stopping malware/leaks, which seems quite reasonable.

As the grandparent of this thread, I can definitely say I don't care about personal browsing on work computers. I consider that an HR issue (if it impacts their ability to do their job), not an IT issue. The ability to manage network traffic comes entirely from maintaining a secure and functional network.

Re: Encrypted Client Hello

#209

Post by Anunayj »

jacooper wrote: post #204
Groxx wrote: post #142

Earlier quoted context omitted.

I think the remark is because: MITM would allow them to spoof the DNS response entirely, so they can replace it with whatever key they want. Doesn't matter what level of security the key claims at that point, it's attacker-controlled and they can just read whatever you send next.

This wouldn't be possible with dnssec right?

Yes, however it defeats one of the main point of ECH, that is encrypting the SNI. Since the domain is leaked in plaintext DNS.

Re: Encrypted Client Hello

#210

Post by cryptonym »

Aissen wrote: post #8
ploum wrote: post #3

If I understand this right, it is basically "cloudfare will appear like a huge web server for anybody watching". This looks like one more attempt by cloudfare to recentralize the web. And it doesn’t address the issue that cloudfare still perfectly know which website you are visiting. Did I miss something?

In this case, the centralization is an advantage for privacy, depending on how you look. Basically, no one can guess who you are trying to connect to by looking at the packets (modulo fingerprinting…). This is bad if you are a government, company, school or user that wants to inspect traffic coming out of black-box devices: it's harder to block all of Cloudflare. But this is good if you live in a country where servic…

The real catch is centralisation makes surveillance way easier. When all communications are centralised to CF, it's a piece of cake for a government to eavesdrop by going directly after CF. It gives way more information than SNI and if they want to do business in your country they won't have other choice than complying.
Post reply on HN