5 ms·

I feel like this is only possible because Cloudflare is already so huge. If this becomes widely adopted, anyone who wants to offer "private" access to their sit

I feel like this is only possible because Cloudflare is already so huge. If this becomes widely adopted, anyone who wants to offer "private" access to their site will have to move through Cloudflare. This can't be good.

galadran 3y ago
Any provider can deploy ECH, it's standardized at the IETF. Cloudflare are just first.
- discardedrefuse 3y ago
  Thanks for the info. This feels a little better. I can still envision only a handful of "providers" becoming the defacto gatekeepers to a private web. I'm gonna have to give this some more thought though.
Avamander 3y ago
A lot of shared hosting providers would also be able to implement this. Bringing the benefits of ECH's anti-snooping to many end-users outside of CloudFlare. Individual servers hosting one single website won't benefit much though. Unless you do encrypted split-DNS, I guess.
- discardedrefuse 3y ago
  Thanks for the info.
josephcsible 3y ago
That's not something Cloudflare decided, though. It's just a fundamental limitation on how the Internet works. The destination IP needs to be visible to intermediate nodes so that they know how to get it there, so the only way to get this kind of privacy is for lots of services to be hosted behind the same destination IP. And keep in mind that it's not Cloudflare exclusive. Any similar service that does large-scale name-based virtual hosting will also give you the same privacy benefit with this.
andrewaylett 3y ago
I'm absolutely not offering to implement it, but it does seem like one ought to be able to proxy the inner hello to the origin so the owner of the shared IP address doesn't actually get to inspect the content of the TLS stream. So if you have a few folk who each want to self-host, you can group together to provide ECH across all your sites without leaking to each other more than you leak to any passive attacker today.
profmonocle 3y ago
Any CDN or shared hosting provider could implement this same standard. The only way it's truly useless is if a web site has its own IP address / small set of IP addresses. (Or if the user isn't using some form of DNS privacy like DNS-over-HTTPS/TLS, but then their domain connections are exposed regardless of whether their CDN/host implements ECH.)

galadran 3y ago

Any provider can deploy ECH, it's standardized at the IETF. Cloudflare are just first.

discardedrefuse 3y ago
Thanks for the info. This feels a little better. I can still envision only a handful of "providers" becoming the defacto gatekeepers to a private web. I'm gonna have to give this some more thought though.

Avamander 3y ago

A lot of shared hosting providers would also be able to implement this. Bringing the benefits of ECH's anti-snooping to many end-users outside of CloudFlare. Individual servers hosting one single website won't benefit much though. Unless you do encrypted split-DNS, I guess.

discardedrefuse 3y ago
Thanks for the info.

josephcsible 3y ago

That's not something Cloudflare decided, though. It's just a fundamental limitation on how the Internet works. The destination IP needs to be visible to intermediate nodes so that they know how to get it there, so the only way to get this kind of privacy is for lots of services to be hosted behind the same destination IP. And keep in mind that it's not Cloudflare exclusive. Any similar service that does large-scale name-based virtual hosting will also give you the same privacy benefit with this.

andrewaylett 3y ago

I'm absolutely not offering to implement it, but it does seem like one ought to be able to proxy the inner hello to the origin so the owner of the shared IP address doesn't actually get to inspect the content of the TLS stream. So if you have a few folk who each want to self-host, you can group together to provide ECH across all your sites without leaking to each other more than you leak to any passive attacker today.

profmonocle 3y ago

Any CDN or shared hosting provider could implement this same standard. The only way it's truly useless is if a web site has its own IP address / small set of IP addresses. (Or if the user isn't using some form of DNS privacy like DNS-over-HTTPS/TLS, but then their domain connections are exposed regardless of whether their CDN/host implements ECH.)