A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn’t great, if contents of the website are behind a paywall maybe copy them into the post
- Don’t promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
- 0 users online
- 124 users / day
- 1.05K users / week
- 1.3K users / month
- 4.58K users / 6 months
- 1 subscriber
- 3.9K Posts
- 98.3K Comments
- Modlog
in the olden days, one ipv4 could host one domain securely. when a client connected to that ip, the connection was encrypted with the cert for that domain it was hosting.
the finite ipv4 space was gobbled up like crazy between this and every fucking thing on the planet wanting to be online.
an update to conserve ipv4 space allows one to host multiple domains (i.e. different sites on different domains, all using https) on one ip. to do this, the client needs tells the server which domain it’s looking for on the ip it’s connecting to–in the clear. once the server knows what cert to use, an encrypted connection can be set up.
‘encrypted client hello’ (ech) allows that initial request to be encrypted.
that’s pretty much all it does.
If you don’t trust the server you’re connecting to, why are you connecting to it in the first place? The only difference between ECH and no ECH is that encryption starts earlier.
The initial post is a somewhat incomprehensible rant but I think the objection is that any number of skeezy websites all have domains pointing to the same Cloudflare IP. So when a malware app opens a TLS connection to one of those domains, the shared IP doesn’t tel you anything, and the ECH prevents you from seeing with Wireshark just whose home the malware is phoning. You have to resort to more drastic methods like intercepting DNS. Better yet, don’t run malware.
deleted by creator
… It’s a protocol, not a service. And your browser has it enabled. You can disable it on your browser and default back to esni, and be less private and less anonimized, if you want. No one’s making you use it.
deleted by creator
effectiveness of ublockorigin, noscript, or other privacy/security related addons in your browser are unaffected by ech.
a pihole on your network is likewise unaffected, as it alters the dns requests so clients like your browser or tv can’t even resolve a ‘bad’ domain to an ip.
deleted by creator
I think, OP is pointing to the fact that ECH makes it harder to block connections to mothership from proprietary apps, TVs etc. These apps could now use ECH, DoH to hide it’s traffic from being observed.
But OP could always buy a better router that can proxy layer 7 traffic and block the traffic if desired.