9 ms·

I'm not seeing it. It looks contradictory what they're saying. > This means that whenever a user visits a website on Cloudflare that has ECH enabled, no one ex

I'm not seeing it. It looks contradictory what they're saying. > This means that whenever a user visits a website on Cloudflare that has ECH enabled, no one except for the user and the website will be able to determine which website was visited. But if you look at the inner/outer SNI part: > The outer SNI is a common name that, in our case, represents that a user is trying to visit an encrypted website on Cloudflare. We chose cloudflare-ech.com as the SNI that all websites will share on Cloudflare. Because Cloudflare controls that domain we have the appropriate certificates to be able to negotiate a TLS handshake for that server name. > The inner SNI contains the actual server name that the user is trying to visit. This is encrypted using a public key and can only be read by Cloudflare. Once the handshake completes the web page is loaded as normal, just like any other website loaded over TLS. So Cloudflare sees it? That's definitely not the same as what they're describing, it's more of a wink-wink Applesque "trust me bro" style of "privacy" - a consolidation of traffic under the pretext of something else. I also looked at the draft document they linked, and that seems to match up with what I'm understanding. > If ECHClientHello.type is outer, then the server acts as a client- facing server and proceeds as described in Section 7.1 to extract a ClientHelloInner, if available.

cosmosgenius 3y ago
Cloudflare sees it here because the TLS is closed at Cloudflare end. ECH main point is the prevent traffic snooping by ISPs. In India a lot of websites are blocked due to gov regulations. Those blocks are implemented via the inspection of the ClientHello packet to know which website are being accessed. Hopefully this will prevent such blocks.
TrueDuality 3y ago
You're absolutely right, Cloudflare will still see it. That doesn't make this a bad improvement though. You don't have to use Cloudflare to support it, but it helps obscure which site is being visited by the nature of Cloudflare hosting so many different sites. So what does this actually protect against? Who will this benefit? Mostly people in censored countries and companies. This removes the last piece of information that can be used to block HTTPS traffic based on the site your visiting without being a party to the exchange. I still think DoH is hot garbage and the way it has been implemented across browsers is an atrocity. It's actively harmful to security even if the spirit is in the right place. I've got no complaints about ECH.
- vasachi 3y ago
  > This removes the last piece of information that can be used to block HTTPS traffic based on the site your visiting without being a party to the exchange. And that will cause blocks by IP. It's not like authorities in those countries care that much if a user can't access a not-blocked site, as long as they can't access a blocked one.
  - josephcsible 3y ago
    The point of efforts like this is exactly to make selective blocking infeasible. This will force the bad guys to choose between blocking nothing and blocking everything, and with the exception of North Korea, most aren't willing to do the latter.
    - vasachi 3y ago
      Nope, the bad guys don't care that much.
      - jamespo 3y ago
        Who are you talking about?
- kreetx 3y ago
  What is wrong with DoH?
  - johnklos 3y ago
    It takes our control over our networks away from us and gives it to random applications, to Trojans, to viruses, to adware purveyors, to advertisers. It makes the assertion that because SOME of us don't know how to change our DNS servers, they (Mozilla, Cloudflare, other proponents of DoH) need to take control away from us and need to send our DNS lookups to, usually, them. The justifications are ridiculous, but the harms introduced by DoH are much, much worse than the thing they're trying to say makes DoH useful.
galadran 3y ago
The point is that network operators can't tell which website the user is visiting, as it could be any of the sites hosted by the ECH provider. In this case, Cloudflare are acting as the ECH provider and as they already host the websites, they already see the connection plaintext.
jacooper 3y ago
Generally cloudflare assumes itself as being a part of the website. Its not the fiest time they did this.
josephcsible 3y ago
When you visit a site on Cloudflare today, both Cloudflare and your ISP see the domain name. With ECH, only Cloudflare will.
- folmar 3y ago
  When I visit a more local website only my ISP and the site's ISP will see the domain name. With default browser setting some, probably overseas, entity that I didn't trust and didn't choose gets my request, ignoring my system configuration and without asking.
  - josephcsible 3y ago
    The entities that can see the domain you're visiting with ECH are a strict subset of those that can without ECH.
    - folmar 3y ago
      Sorry, you are right. I was thinking I'm still in a thread on DOH.
morpheuskafka 3y ago
Doesn't Cloudflare already terminate TLS anyway? As far as TLS is concerned, Cloudflare is "the website."
stefan_ 3y ago
You are missing the big picture. Of course CF still sees it - they need to route your request somewhere (remember why SNI is a thing at all and we don't just use DNS) and you are after all choosing to talk to a CF server. But it means not everyone on your network that happens to see your traffic can trivially see you are visiting pornhub.com
e12e 3y ago
Not sure if it was edited, but TFA states near the top now: > This means that whenever a user visits a website on Cloudflare that has ECH enabled, no one except for the user, Cloudflare, and the website owner will be able to determine which website was visited. Which sounds more precise and correct. I very much agree that these details matter.
wolverine876 3y ago
Did they fix it? Now it reads, > This means that whenever a user visits a website on Cloudflare that has ECH enabled, no one except for the user, Cloudflare, and the website owner will be able to determine which website was visited.
madeofpalk 3y ago
Here, Cloudflare is "the website" because they're terminating the TLS.

cosmosgenius 3y ago

Cloudflare sees it here because the TLS is closed at Cloudflare end. ECH main point is the prevent traffic snooping by ISPs. In India a lot of websites are blocked due to gov regulations. Those blocks are implemented via the inspection of the ClientHello packet to know which website are being accessed. Hopefully this will prevent such blocks.

TrueDuality 3y ago

You're absolutely right, Cloudflare will still see it. That doesn't make this a bad improvement though. You don't have to use Cloudflare to support it, but it helps obscure which site is being visited by the nature of Cloudflare hosting so many different sites. So what does this actually protect against? Who will this benefit? Mostly people in censored countries and companies. This removes the last piece of information that can be used to block HTTPS traffic based on the site your visiting without being a party to the exchange. I still think DoH is hot garbage and the way it has been implemented across browsers is an atrocity. It's actively harmful to security even if the spirit is in the right place. I've got no complaints about ECH.

vasachi 3y ago
> This removes the last piece of information that can be used to block HTTPS traffic based on the site your visiting without being a party to the exchange. And that will cause blocks by IP. It's not like authorities in those countries care that much if a user can't access a not-blocked site, as long as they can't access a blocked one.
- josephcsible 3y ago
  The point of efforts like this is exactly to make selective blocking infeasible. This will force the bad guys to choose between blocking nothing and blocking everything, and with the exception of North Korea, most aren't willing to do the latter.
  - vasachi 3y ago
    Nope, the bad guys don't care that much.
    - jamespo 3y ago
      Who are you talking about?
kreetx 3y ago
What is wrong with DoH?
- johnklos 3y ago
  It takes our control over our networks away from us and gives it to random applications, to Trojans, to viruses, to adware purveyors, to advertisers. It makes the assertion that because SOME of us don't know how to change our DNS servers, they (Mozilla, Cloudflare, other proponents of DoH) need to take control away from us and need to send our DNS lookups to, usually, them. The justifications are ridiculous, but the harms introduced by DoH are much, much worse than the thing they're trying to say makes DoH useful.

galadran 3y ago

The point is that network operators can't tell which website the user is visiting, as it could be any of the sites hosted by the ECH provider. In this case, Cloudflare are acting as the ECH provider and as they already host the websites, they already see the connection plaintext.

jacooper 3y ago

Generally cloudflare assumes itself as being a part of the website. Its not the fiest time they did this.

josephcsible 3y ago

When you visit a site on Cloudflare today, both Cloudflare and your ISP see the domain name. With ECH, only Cloudflare will.

folmar 3y ago
When I visit a more local website only my ISP and the site's ISP will see the domain name. With default browser setting some, probably overseas, entity that I didn't trust and didn't choose gets my request, ignoring my system configuration and without asking.
- josephcsible 3y ago
  The entities that can see the domain you're visiting with ECH are a strict subset of those that can without ECH.
  - folmar 3y ago
    Sorry, you are right. I was thinking I'm still in a thread on DOH.

morpheuskafka 3y ago

Doesn't Cloudflare already terminate TLS anyway? As far as TLS is concerned, Cloudflare is "the website."

stefan_ 3y ago

You are missing the big picture. Of course CF still sees it - they need to route your request somewhere (remember why SNI is a thing at all and we don't just use DNS) and you are after all choosing to talk to a CF server. But it means not everyone on your network that happens to see your traffic can trivially see you are visiting pornhub.com

e12e 3y ago

Not sure if it was edited, but TFA states near the top now: > This means that whenever a user visits a website on Cloudflare that has ECH enabled, no one except for the user, Cloudflare, and the website owner will be able to determine which website was visited. Which sounds more precise and correct. I very much agree that these details matter.

wolverine876 3y ago

Did they fix it? Now it reads, > This means that whenever a user visits a website on Cloudflare that has ECH enabled, no one except for the user, Cloudflare, and the website owner will be able to determine which website was visited.

madeofpalk 3y ago

Here, Cloudflare is "the website" because they're terminating the TLS.