{"id":110431,"date":"2023-10-04T15:10:15","date_gmt":"2023-10-04T13:10:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike"},"modified":"2023-10-04T15:10:15","modified_gmt":"2023-10-04T13:10:16","slug":"v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","title":{"rendered":"I Firefox og Cloudflare er der inkluderet support til ECH til skjulning af dom\u00e6net i HTTPS-trafikken","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Mozilla har annonceret, at de i den stabile version af Firefox vil introducere st\u00f8tte til ECH (Encrypted Client Hello), som forts\u00e6tter udviklingen af teknologien ESNI (Encrypted Server Name Indication) og er designet til at kryptere oplysninger om TLS-sessioner, s\u00e5som det anmodede dom\u00e6nenavn. Oprindeligt blev koden til ECH tilf\u00f8jet i Firefox 85, men var deaktiveret som standard. I Chrome begyndte st\u00f8tten til ECH gradvist at blive aktiveret fra version 115. <\/p>\n

Da forbindelsen til serveren<\/a> l\u00e6kkage af oplysninger om anmodede dom\u00e6ner sker via DNS, kr\u00e6ves der udover ECH ogs\u00e5 anvendelse af teknologien DNS over HTTPS eller DNS over TLS for at kryptere DNS-trafik. Firefox vil ikke bruge ECH uden aktivationen af DNS over HTTPS i indstillingerne. Du kan kontrollere underst\u00f8ttelsen af ECH i browseren p\u00e5 denne side. <\/p>\n

En af grundene til, at ECH-st\u00f8tte nu er aktiveret som standard i Firefox, er, at Cloudflare for f\u00e5 dage siden aktiverede ECH-st\u00f8tte i deres indholdsleveringsnetv\u00e6rk. Praktisk set, da oplysningerne om anmodede v\u00e6rter er skjult for analyse ved brug af ECH, for at filtrere og blokere u\u00f8nskede websteder, der bruger Cloudflares CDN, kr\u00e6ves der nu enten blokering af hele Cloudflares netv\u00e6rk, blokering af alle anmodninger med ECH, eller ops\u00e6tning af HTTPS-interception ved hj\u00e6lp af falske rodcertifikater p\u00e5 brugerens system. <\/p>\n

Oprindeligt blev TLS-udvidelsen SNI anvendt for at organisere drift af flere HTTPS-websteder p\u00e5 \u00e9n IP-adresse, hvor det anmodede v\u00e6rtsnavn blev angivet i ClientHello-meddelelsen, der blev sendt f\u00f8r etableringen af den krypterede kommunikationskanal. Denne egenskab gjorde det muligt i de tidlige faser af forbindelsesbehandlingen at fordele anmodningerne til virtuelle v\u00e6rter, men tillod ogs\u00e5 internetudbyderen at filtrere HTTPS-trafik selektivt og analysere, hvilke websteder brugeren bes\u00f8ger, hvilket ikke gjorde det muligt at opn\u00e5 fuld fortrolighed ved brug af HTTPS. <\/p>\n

For solving this problem and preventing leakage of information about the requested site, the ESNI extension, which implements encryption of hostnames, was proposed later. During the implementation of ESNI, it was discovered that the proposed mechanism does not cover all possible sources of data leakage about the host and its use is insufficient for ensuring complete confidentiality of HTTPS sessions. In particular, when resuming a previously established session, the domain name continued to be indicated in plain text among the parameters of the PSK (Pre-Shared Key) TLS extension. Additionally, attempts to implement ESNI revealed compatibility and scalability issues that hindered its widespread adoption. <\/p>\n

I betragtning af de identificerede mangler ved ESNI er der udviklet en ny universel mekanisme, ECH, som tillader kryptering af parametre for enhver TLS-udvidelse. Teknisk set er den prim\u00e6re forskel mellem ECH og ESNI, at hele ClientHello-beskeden krypteres i stedet for blot enkelte felter. ECH indeb\u00e6rer opdeling af ClientHello i to separate beskeder \u2014 den krypterede besked ClientHelloInner (SNI Inner) og den ukrypterede basisbesked ClientHelloOuter (SNI Outer). I den ukrypterede SNI Outer sendes ikke-fortrolige data som TLS-version og listen over anvendte krypteringsmetoder, samt et f\u00e6lles dom\u00e6nenavn, der ikke overlapper med det faktiske navngivne dom\u00e6ne. For eksempel angives den f\u00e6lles v\u00e6rt \"cloudflare-ech.com\" i den ukrypterede SNI Outer for alle Cloudflare-klienter, mens det faktiske navngivne v\u00e6rt sendes i den krypterede SNI Inner og ikke er tilg\u00e6ngeligt for analyse.

\"I<\/center> <\/p>\n

ECH benytter ogs\u00e5 en anden n\u00f8glefordelingsordning for kryptering \u2014 oplysninger om den offentlige n\u00f8gle sendes i DNS-posterne HTTPSSVC i stedet for i posterne med typen TXT. For at modtage og kryptere n\u00f8glen anvendes autentificeret ende-til-ende-kryptering baseret p\u00e5 mekanismen HPKE (Hybrid Public Key Encryption). ECH underst\u00f8tter ogs\u00e5 sikker n\u00f8glegenudsendelse fra serveren, hvilket kan anvendes i forbindelse med n\u00f8gleskift. serveren<\/a> and to resolve issues when obtaining outdated keys from the DNS cache.
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 Firefox \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 ECH (Encrypted Client Hello), \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 ESNI (Encrypted Server Name Indication) \u0438 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043b\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u0445 TLS-\u0441\u0435\u0430\u043d\u0441\u043e\u0432, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a \u0437\u0430\u043f\u0440\u043e\u0448\u0435\u043d\u043d\u043e\u0435 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0435 \u0438\u043c\u044f. \u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043a\u043e\u0434 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 ECH \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u0432 \u0432\u044b\u043f\u0443\u0441\u043a Firefox 85, \u043d\u043e \u0431\u044b\u043b \u043e\u0442\u043a\u043b\u044e\u0447\u0451\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0412 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":110432,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110431","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47I Firefox og Cloudflare er der tilf\u00f8jet st\u00f8tte til ECH for at skjule dom\u00e6net i HTTPS-trafik | ProHoster","description":"Mozilla has announced the inclusion of support for the ECH (Encrypted Client Hello) mechanism for users of the stable version of Firefox, continuing the development of the ESNI (Encrypted Server Name Indication) technology.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Firefox \u0438 Cloudflare \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 ECH \u0434\u043b\u044f \u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0434\u043e\u043c\u0435\u043d\u0430 \u0432 HTTPS-\u0442\u0440\u0430\u0444\u0438\u043a\u0435 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 Firefox \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 ECH (Encrypted Client Hello), \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 ESNI (Encrypted Server Name Indication) \u0438.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-04T13:10:16+00:00","article:modified_time":"2023-10-04T13:10:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"110431","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:39:44","updated":"2026-02-09 21:46:41","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/110431","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=110431"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/110431\/revisions"}],"predecessor-version":[{"id":160302,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/110431\/revisions\/160302"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/110432"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=110431"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=110431"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=110431"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}