4 ms·

CloudFlare has supported it since 2023: https://blog.cloudflare.com/announcing-encrypted-client-hello/and https://blog.cloudflare.com/announcing-encrypted-clien

by arcfour 6mo ago

CloudFlare has supported it since 2023: https://blog.cloudflare.com/announcing-encrypted-client-hello/and https://blog.cloudflare.com/announcing-encrypted-client-hell... Firefox has had it enabled by default since version 119: https://support.mozilla.org/en-US/kb/faq-encrypted-client-hello#w_how-do-i-enable-ech-in-firefox https://support.mozilla.org/en-US/kb/faq-encrypted-client-he... so you can use it today.

bombcar 6mo ago
https://tls-ech.dev https://tls-ech.dev indicates that Safari doesn't support it, but Chrome does.
- altairprime 6mo ago
  That’s likely due to iOS/macOS not supporting it in production-default-enabled yet; there’s an experimental opt-in flag at the OS level, but Safari apparently hasn’t (yet) added a dev feature switch for it. https://developer.apple.com/documentation/security/sec_protocol_options_set_enable_encrypted_client_hello https://developer.apple.com/documentation/security/sec_proto... Presumably anyone besides Safari can opt-in to that testing today, but I wouldn’t ship it worldwide and expect nice outcomes until (I suspect) after this fall’s 27 releases. Maybe someone could PR the WebKit team to add that feature flag in the meantime?
1vuio0pswjnm7 6mo ago
"... so you can use it today." What if he wanted to use it for requesting blog.cloudflare.com ;; ANSWER SECTION: blog.cloudflare.com. 300 IN HTTPS 1 . alpn="h3,h2" ipv4hint=104.18.28.7,104.18.29.7 ipv6hint=2606:4700::6812:1c07,2606:4700::6812:1d07 Where are the ECH keys For example, ;; ANSWER SECTION: test.defo.ie. 300 IN HTTPS 1 . ech="AEb+DQBCqQAgACBlm7cfDx/gKuUAwRTe+Y9MExbIyuLpLcgTORIdi69uewAEAAEAAQATcHVibGljLnRlc3QuZGVmby5pZQAA" or ;; ANSWER SECTION: cloudflare-ech.com. 300 IN HTTPS 1 . alpn="h3,h2" ipv4hint=104.18.10.118,104.18.11.118 ech="AEX+DQBBpQAgACB/RU5hAC5mXe3uOZtNY58Bc8UU1cd4QBxQzqirMlWZeQAEAAEAAQASY2xvdWRmbGFyZS1lY2guY29tAAA=" ipv6hint=2606:4700::6812:a76,2606:4700::6812:b76 It's true one can "use it today". One could use it for the past several years as well. The software has been around for a while But ECH has never been consistently enabled for the general public beyond a small number of test sites that are only for testing ECH

by arcfour 6mo ago

bombcar 6mo ago

https://tls-ech.dev https://tls-ech.dev indicates that Safari doesn't support it, but Chrome does.

altairprime 6mo ago
That’s likely due to iOS/macOS not supporting it in production-default-enabled yet; there’s an experimental opt-in flag at the OS level, but Safari apparently hasn’t (yet) added a dev feature switch for it. https://developer.apple.com/documentation/security/sec_protocol_options_set_enable_encrypted_client_hello https://developer.apple.com/documentation/security/sec_proto... Presumably anyone besides Safari can opt-in to that testing today, but I wouldn’t ship it worldwide and expect nice outcomes until (I suspect) after this fall’s 27 releases. Maybe someone could PR the WebKit team to add that feature flag in the meantime?

1vuio0pswjnm7 6mo ago

"... so you can use it today." What if he wanted to use it for requesting blog.cloudflare.com ;; ANSWER SECTION: blog.cloudflare.com. 300 IN HTTPS 1 . alpn="h3,h2" ipv4hint=104.18.28.7,104.18.29.7 ipv6hint=2606:4700::6812:1c07,2606:4700::6812:1d07 Where are the ECH keys For example, ;; ANSWER SECTION: test.defo.ie. 300 IN HTTPS 1 . ech="AEb+DQBCqQAgACBlm7cfDx/gKuUAwRTe+Y9MExbIyuLpLcgTORIdi69uewAEAAEAAQATcHVibGljLnRlc3QuZGVmby5pZQAA" or ;; ANSWER SECTION: cloudflare-ech.com. 300 IN HTTPS 1 . alpn="h3,h2" ipv4hint=104.18.10.118,104.18.11.118 ech="AEX+DQBBpQAgACB/RU5hAC5mXe3uOZtNY58Bc8UU1cd4QBxQzqirMlWZeQAEAAEAAQASY2xvdWRmbGFyZS1lY2guY29tAAA=" ipv6hint=2606:4700::6812:a76,2606:4700::6812:b76 It's true one can "use it today". One could use it for the past several years as well. The software has been around for a while But ECH has never been consistently enabled for the general public beyond a small number of test sites that are only for testing ECH