4 ms·
It doesn't prevent fingerprinting, stop spreading misinformation. It only prevents your ISP from knowing what website you're connecting to.
by szmarczak 8mo ago
It doesn't prevent fingerprinting, stop spreading misinformation. It only prevents your ISP from knowing what website you're connecting to.
- hzwanip 8mo agoWhat OP wrote seems correct: > ECH basically kills TLS fingerprinting as a bot detection signal They are not talking about fingerprinting in general. Please elaborate how else TLS fingerprinting can be done.
- szmarczak 8mo agoI am talking about TLS fingerprinting, not JS fingerprinting. > Please elaborate how else TLS fingerprinting can be done. By doing everything as it is right now?
- hzwanip 8mo agoHow would you (an arbitrary web server) fingerprint a TLS connection if the Client Hello is encrypted?
- conradludgate 8mo agoThe website owner (or cloudflare in this case) has the keys to decrypt the client hello. That's necessary for routing information.
- hzwanip 8mo agoYou're right, sorry! I got confused myself.
- szmarczak 8mo agoBy decrypting it? I don't think you know how TLS, or E2E works in general. ISP doesn't perform the fingerprinting, the server does.
- hzwanip 8mo agoOf course! My bad, thanks for engaging.
- maxloh 8mo agoSince most ISPs also maintain their own DNS resolver, they could always reverse lookup the IP address AFAIK.
- szmarczak 8mo agoTrue. ECH is useless if you're using plain DNS. DNS over TLS or HTTPS is the way to go.
- progbits 8mo agoThe whole idea behind ECH is one IP hosts tons of sites (eg. CDN) so you have no idea which one it is. Also reverse lookup has nothing to do with hosting own DNS resolver.
- szmarczak 8mo agoWhat you're describing is a SNI, not ECH. Those two serve very different purposes. > Also reverse lookup has nothing to do with hosting own DNS resolver. It has everything to do with that. Had you used two brain cells, you would've known that they can memorize the IP address and the domain name, and if you connect to that IP in a short period of time, most likely you visited that domain name.
- CloakHQ 8mo ago[flagged]
- gzread 8mo agoWhy would Clownflare ever see traffic to sites not on Clownflare?
- szmarczak 8mo agoThey do routing. Even if you're connecting to a non Cloudflare server, the traffic may still be routed through their servers. Why would they want to peek traffic? Most likely for statistics (most frequently visited websites etc).
- gzread 8mo agoCan you give an example of a BGP route or traceroute to a site not on Clownflare that was routed through Clownflare?
- szmarczak 8mo agoIt depends on the origin and the destination. Their Magic Transit service explicitly allow this, and I assume they have agreements with other AS in case something goes wrong on either side (it often does). You'd have to directly ask them to know specifically but I don't think they would answer since that's proprietary information.
- szmarczak 8mo ago> the part that changes is passive fingerprinting from third parties That's exactly what I said: > It only prevents your ISP from knowing what website you're connecting to.
- Hizonner 8mo ago> the part that changes is passive fingerprinting from third parties - network middleboxes, ISPs, DPI systems Right. Things that should never have been allowed to exist to begin with. Working as designed.