Say (an encrypted) hello to a more private internet. | The Mozilla Blog
blog.mozilla.org
As web users, what we say and do online is subject to pervasive surveillance. Although we typically associate online tracking with ad networks and other th
    • jsdz@lemmy.ml
      5·
      1 year ago

      Sort of. They can still see which IP address you’re connecting to, which by itself or in combination with some minor traffic analysis is quite often enough to identify which website you’ve visited. Perhaps it isn’t if the website puts absolutely everything through a giant CDN like Cloudflare, but in that case it’s Cloudflare which gets to see all the sites you visit which isn’t a whole lot better than the status quo.

      Still, it’s a little less information given away at least some of the time. Better to do it than not do it.

    • sloppy_diffuser@sh.itjust.worksEnglish
      1·
      1 year ago

      It’s been a couple years since I was involved with ECH, but the implementations at the time were:

      The one by the draft’s authors in golang (Cloudflare). This is the actual test server. It uses Cloudflare’s fork of golang with an enhanced crypto library. https://gist.github.com/cjpatton/da8814704b8daa48cb6c16eafdb8e402

      BoringSSL used for chrome. There are nginx builds with BoringSSL, but I don’t know if the setting are exposed.

      https://boringssl.googlesource.com/boringssl/+/refs/heads/master/ssl/encrypted_client_hello.cc

      WolfSSL which I never got around to playing with.

      https://www.wolfssl.com/encrypted-client-hello-ech-now-supported-wolfssl/

      NSS which is Mozilla’s TLS library. There is a test server buried in there some place for unit testing.

      https://firefox-source-docs.mozilla.org/security/nss/index.html

      With that, you ALSO need a DNS server that supports DNS over HTTP (DoH) and HTTPS service binding records (https://datatracker.ietf.org/doc/draft-ietf-dnsop-svcb-https/).

      Bind9 had branches for both and I was able merge the two to satisfy that requirement.

      When connecting to such a server, you MUST NOT use a DNS resolver hosted by any origination along the path from client to server as they can correlate the host from the DNS request with your encrypted client hello. You can actually man-in-the-middle ECH to decrypt the client hello by overriding the hosts record when controlling the DNS resolver. My project was testing this for parental controls.

      Keep in mind, ECH really only benefits users connecting to a CDN. That is, when multiple services are behind the same IP. It masks which host the user is going to for any hop between the client and server.

      Any data mining company worth their evils will have an IP to DNS index to figure out the host when only one is behind an IP.

      This marginally gives some privacy to users. It hides the host from your ISP. It REALLY benefits browser companies and CDN hosts. What hosts a user is visiting now becomes exclusive data for those companies thereby driving up the value of the data. Assuming you aren’t being stupid with your addons.

  • Karna@lemmy.mlEnglish
    2·
    1 year ago

    In my opinion, Firefox should give an option to enable ECH forcefully for users like me who has AdGuardHome/Pi-Hole running on Home Network. Currently, if DOH is disabled in Firefox setting, ECH won’t work, as per Firefox. 😦

    • LastYearsPumpkin@feddit.chEnglish
      4·
      1 year ago

      And HTTPS relies on hosts managing SSL certificates. Web services don’t use them until it hits a critical mass, then it becomes weird and broken when you aren’t using it.

      This just needs some time to settle in.

      • DarkThoughts@kbin.social
        1·
        1 year ago

        I remember when absolutely no one used https and then in a matter of a couple years things got really fast. Now you can easily browse with https required and only occasionally find the odd website that doesn’t use it (mostly some internet relic). That was such a great transition when it happened though.

    • Gestrid@lemmy.caEnglish
      1·
      1 year ago

      Apparently, Cloudflare already supports ECH, and a not-insignificant number of websites use them.

  • miss_brainfart@lemmy.ml
    1·
    1 year ago

    https://support.mozilla.org/en-US/kb/faq-encrypted-client-hello#w_can-i-use-ech-alongside-other-security-tools-like-ad-blockers

    Users using DNS-based filtering may need to tweak their configuration in order to make use of ECH. Firefox needs to be configured with a DNS-over-HTTPS server in order to make use of ECH. Depending on whether the DNS filter is locally hosted or hosted by an online provider, instructions for connecting to it over DoH will differ and users of these services will need to check their accompanying documentation.

    Sooo, I’m a bit lost here. How do I ensure everything’s working when I’m using a pihole? I don’t think I’m understanding everything correctly

    • TheKaul@lemmy.dbzer0.com
      1·
      1 year ago

      It sounds like you’ll have to set your Pihole as the DNS server in Firefox’s settings, and then maybe from there it’ll work itself out? Or maybe the Pihole documentation will be updated in the next few days with some instructions on enabling this. I’m unsure myself to be honest.

      • miss_brainfart@lemmy.ml
        1·
        1 year ago

        That would make sense, wouldn’t it? I think I’m going to wait for the pihole team to inform about this.