Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New standards for a faster and more private Internet

blog.cloudflare.com

Post reply on HN
Print view View original

51–60 of 87 posts

Re: New standards for a faster and more private Internet

#51

Post by schoen »

Shakahs wrote: post #42
Animats wrote: post #38

"This means that whenever a user visits a website on Cloudflare that has ECH enabled, no one except for the user, Cloudflare, and the website owner will be able to determine which website was visited. Cloudflare is a big proponent of privacy for everyone and is excited about the prospects of bringing this technology to life.' This isn't privacy. This is centralized snooping. It's like Google's approach to third party…

Another HN hot take about the Cloudflare bogeyman. The CDN can't give you content you're asking for without knowing which content you're asking for. This improvement prevents your ISP and the government from reading your packets to get that same information.

> The CDN can't give you content you're asking for without knowing which content you're asking for.

Maybe some PIR protocol can also eventually change this (if the users and Cloudflare don't mind the computational and network overhead!).

Re: New standards for a faster and more private Internet

#52

Post by sedatk »

DPI systems in Turkey weren't even checking QUIC packets when I was there, let alone ECH. But, browsers usually start with TCP first to negotiate QUIC support, which prevented bypass of web blocks. If you could force your browser to establish connection directly using QUIC, you could bypass all the blocks. That was last year though. Not sure about the current situation.

Re: New standards for a faster and more private Internet

#53

Post by lifthrasiir »

irq-1 wrote: post #21

What will ECH mean for places like China or South Korea? Do governments have access to Cloudflare logs? Only with court orders? ECH seems directly opposed to Chinese governments control of the web.

There are many more countries enforcing some limitations on the internet, and ECH will just turn passive DPI into active court orders, I believe. At least explictness is better.

Re: New standards for a faster and more private Internet

#54

Post by api »

sedatk wrote: post #50
Animats wrote: post #38

"This means that whenever a user visits a website on Cloudflare that has ECH enabled, no one except for the user, Cloudflare, and the website owner will be able to determine which website was visited. Cloudflare is a big proponent of privacy for everyone and is excited about the prospects of bringing this technology to life.' This isn't privacy. This is centralized snooping. It's like Google's approach to third party…

> This isn't privacy. It will be when everyone adopts ECH. It's a fantastic start.

Doesn't Cloudflare decrypt and MITM all traffic? In that case they can snoop on everything.

Re: New standards for a faster and more private Internet

#55

Post by lifthrasiir »

The benchmark for Zstandard against Brotli seems to miss a key information---the compression levels used for both algorithms, because both the compression ratio and compression time will depend on them. In fact this had been my long suspicion about introducing Zstandard to the web standard, because lower compression levels for Brotli are not that slow and it was never publicly mentioned whether improving lower Brotli levels deemed infeasible or not. Given Zstandard Content-Encoding was initially proposed by Meta, I'm not even sure they have at least tried.

Given we now have two strictly better algorithms than gzip, I also wonder about a hybrid scheme that starts with Zstandard but switches to Brotli when the compression time is no longer significant for given request. We might even be able to cheaply convert the existing Zstandard stream into Brotli with some restrictions, as they are really LZSS behind the scene?

Re: New standards for a faster and more private Internet

#56

Post by winkelmann »

nicce wrote: post #33
terrelln wrote: post #4

Earlier quoted context omitted.

I believe that the "more private" part is referencing the "Encrypted Client Hello (ECH)" section in the later part of the post.

It is about moving the trust. > This means that whenever a user visits a website on Cloudflare that has ECH enabled, no one except for the user, Cloudflare, and the website owner will be able to determine which website was visited. So you must use entity which controls the DNS and this entity makes the request further for actual website. Feels like just worse VPN.

> It is about moving the trust.

Trust isn't being moved, though. Cloudflare could, by design, always see what website you were accessing. The difference is with ECH, there is one less party (someone listening in on your internet traffic) that can see which hostname you're accessing.

Re: New standards for a faster and more private Internet

#57

Post by lifthrasiir »

api wrote: post #54
sedatk wrote: post #50

Earlier quoted context omitted.

> This isn't privacy. It will be when everyone adopts ECH. It's a fantastic start.

Doesn't Cloudflare decrypt and MITM all traffic? In that case they can snoop on everything.

Only true when the entire Internet is routed through Cloudflare. (A majority probably will, but the GP surely meant this.)

Re: New standards for a faster and more private Internet

#60

Post by terrelln »

lifthrasiir wrote: post #55

The benchmark for Zstandard against Brotli seems to miss a key information---the compression levels used for both algorithms, because both the compression ratio and compression time will depend on them. In fact this had been my long suspicion about introducing Zstandard to the web standard, because lower compression levels for Brotli are not that slow and it was never publicly mentioned whether improving lower Brotli…

Meta drove the Zstandard content encoding, but Google drove the adoption of Zstandard in Chrome.

The faster Brotli levels could probably be made to match Zstandard’s compression speed. But we’ve invested a lot in optimizing these levels, so it would likely take significant investment to match. Google is also contributing to improving the speed of Zstandard compression.

A cheaper conversion from Zstandard to Brotli is possible, but I wouldn’t really expect an improvement to compressed size. The encoding scheme impacts how efficient a LZ coding is, so for Brotli to beat Zstandard, it would likely want a different LZ than Zstandard uses. The same applies for a conversion from Brotli to Zstandard.

Post reply on HN