What will ECH mean for places like China or South Korea? Do governments have access to Cloudflare logs? Only with court orders?
ECH seems directly opposed to Chinese governments control of the web.
New standards for a faster and more private Internet
21–30 of 87 posts
Re: New standards for a faster and more private Internet
#22Does it mean ECH works only with the Cloudflare since their example ECH contains unencrypted outer layer client hello?
No, it's am emerging standard. We are just pushing its adoption as fast as we can. Hence, we've rolled this out to all free customers.
And for non free customers, you can opt-in to ECH via the dashboard
Re: New standards for a faster and more private Internet
#23Earlier quoted context omitted.
Nah, they're just going to block the whole ECH handshake. Idk about Iran, but Russia and China just block eSNI, QUIC and whatever their DPI firewalls can't really handle on the fly.
The idea is to make ECH too large of a target to make blocking it practical. If you block ECH you end up blocking access to a large portion of the internet in that region. It's why some major browsers have chosen to not gracefully fallback to non-ECH handshakes upon connection failure.
I think the other poster was implying that the governments don’t care.
Re: New standards for a faster and more private Internet
#24Earlier quoted context omitted.
The idea is to make ECH too large of a target to make blocking it practical. If you block ECH you end up blocking access to a large portion of the internet in that region. It's why some major browsers have chosen to not gracefully fallback to non-ECH handshakes upon connection failure.
I think the other poster was implying that the governments don’t care.
Yeah we shall see - we're monitoring closely
Re: New standards for a faster and more private Internet
#25Earlier quoted context omitted.
I believe that the "more private" part is referencing the "Encrypted Client Hello (ECH)" section in the later part of the post.
The title of something should reflect the content. This is an article about a new compression format, and thus the title should say that.
The first third of the article is indeed, maybe read the rest?
Re: New standards for a faster and more private Internet
#26What will ECH mean for places like China or South Korea? Do governments have access to Cloudflare logs? Only with court orders? ECH seems directly opposed to Chinese governments control of the web.
I think you meant North Korea, not South.
It means nothing. Countries always ask nicely first for a domain to be blocked for IPs from their countries. Companies like Cloudflare or Akamai can either honor the request, or find their IP range blocked (yes, including all the other serviced domains). They usually take the first option.
Re: New standards for a faster and more private Internet
#27Earlier quoted context omitted.
Nah, they're just going to block the whole ECH handshake. Idk about Iran, but Russia and China just block eSNI, QUIC and whatever their DPI firewalls can't really handle on the fly.
The idea is to make ECH too large of a target to make blocking it practical. If you block ECH you end up blocking access to a large portion of the internet in that region. It's why some major browsers have chosen to not gracefully fallback to non-ECH handshakes upon connection failure.
Greetings, residents of Arstotzka! To access Arstotzkan government websites, please install this Ministry of Digits TLS root certificate on all your devices. Also, all new phones sold in Arstotzka must have the certificate preinstalled, starting from 2025.
Re: New standards for a faster and more private Internet
#28Earlier quoted context omitted.
The idea is to make ECH too large of a target to make blocking it practical. If you block ECH you end up blocking access to a large portion of the internet in that region. It's why some major browsers have chosen to not gracefully fallback to non-ECH handshakes upon connection failure.
Greetings, residents of Arstotzka! To access Arstotzkan government websites, please install this Ministry of Digits TLS root certificate on all your devices. Also, all new phones sold in Arstotzka must have the certificate preinstalled, starting from 2025.
Re: New standards for a faster and more private Internet
#29The latest Zstandard exposes several parameters which are useful for reducing time to first byte latency in web compression. They make Zstandard cut the compressed data into smaller blocks, e.g. 4 KB, with the goal to fit a compressed block within a small number of packets, so the browswer can start to decompress without waiting for a full 128 KB block to be sent.
These parameters are described in the v1.5.6 release notes [0]. ZSTD_c_targetCBlockSize is the most notable, but ZSTD_c_maxBlockSize can also be used for a lower CPU cost but larger compressed size.
Are you using these features at Cloudflare? If you need any help using these, or have any questions, please open an issue on Zstandard's GitHub!
Re: New standards for a faster and more private Internet
#30re: ECH let the cat and mice game between deep packet inspection (DPI) vendors and the rest of the encrypted internet continue. it’ll be amusing to see what they come up with (inaccurate guessing game ai/ml “statistical analysis” is about all they’ve got left, especially against the large umbrella that is cloudflare). game on, grab your popcorn, it will be fun to watch.
Not hard to bypass it at all: https://support.mozilla.org/en-US/kb/faq-encrypted-client-he...