3 ms·

If I understand this right, it is basically "cloudfare will appear like a huge web server for anybody watching". This looks like one more attempt by cloudfare

by ploum 3y ago

If I understand this right, it is basically "cloudfare will appear like a huge web server for anybody watching". This looks like one more attempt by cloudfare to recentralize the web. And it doesn’t address the issue that cloudfare still perfectly know which website you are visiting. Did I miss something?

cryptonym 3y ago
You are correct, this is how a CDN typically works. Cloudflare know who you are and got full deciphered observability (can also tamper) for all your traffic with the websites using their services. ECH is not meant to change this fact, you still trust Cloudflare with all communications to their customers.
Aissen 3y ago
In this case, the centralization is an advantage for privacy, depending on how you look. Basically, no one can guess who you are trying to connect to by looking at the packets (modulo fingerprinting…). This is bad if you are a government, company, school or user that wants to inspect traffic coming out of black-box devices: it's harder to block all of Cloudflare. But this is good if you live in a country where service X is blocked because it threatens the local political power. For example, when Signal was blocked in some countries, it used a method named domain fronting to work around that. It relied on a mismatch between SNI and HTTP domains, and all CDNs blocked it in the end. ECH allows having the same result but with plausible deniability for the CDN. Now of course, there's always a catch… Cloudflare used to provide its services to kiwifarms; and what constitutes a legal, or moral thing to do tends to vary around the world.
- cryptonym 3y ago
  The real catch is centralisation makes surveillance way easier. When all communications are centralised to CF, it's a piece of cake for a government to eavesdrop by going directly after CF. It gives way more information than SNI and if they want to do business in your country they won't have other choice than complying.
josephcsible 3y ago
It's not making the Web any more centralized. It's a silver lining we get due to how centralized it already is.
- Racing0461 3y ago
  Agreed. its like if only 2 people uses tor then even though its encrypted and anon, you still know who used tor and can identity those 2 people. Now if a large majority uses tor, then anonymity becomes easier. this is how they caught some guy at harvard that called in a bomb threat via tor. even those he used it, he was the only one in the dorms who used tor so it was traced back to him.

by ploum 3y ago

cryptonym 3y ago

You are correct, this is how a CDN typically works. Cloudflare know who you are and got full deciphered observability (can also tamper) for all your traffic with the websites using their services. ECH is not meant to change this fact, you still trust Cloudflare with all communications to their customers.

Aissen 3y ago

In this case, the centralization is an advantage for privacy, depending on how you look. Basically, no one can guess who you are trying to connect to by looking at the packets (modulo fingerprinting…). This is bad if you are a government, company, school or user that wants to inspect traffic coming out of black-box devices: it's harder to block all of Cloudflare. But this is good if you live in a country where service X is blocked because it threatens the local political power. For example, when Signal was blocked in some countries, it used a method named domain fronting to work around that. It relied on a mismatch between SNI and HTTP domains, and all CDNs blocked it in the end. ECH allows having the same result but with plausible deniability for the CDN. Now of course, there's always a catch… Cloudflare used to provide its services to kiwifarms; and what constitutes a legal, or moral thing to do tends to vary around the world.

cryptonym 3y ago
The real catch is centralisation makes surveillance way easier. When all communications are centralised to CF, it's a piece of cake for a government to eavesdrop by going directly after CF. It gives way more information than SNI and if they want to do business in your country they won't have other choice than complying.

josephcsible 3y ago

It's not making the Web any more centralized. It's a silver lining we get due to how centralized it already is.

Racing0461 3y ago
Agreed. its like if only 2 people uses tor then even though its encrypted and anon, you still know who used tor and can identity those 2 people. Now if a large majority uses tor, then anonymity becomes easier. this is how they caught some guy at harvard that called in a bomb threat via tor. even those he used it, he was the only one in the dorms who used tor so it was traced back to him.