{"id":110431,"date":"2023-10-04T15:10:15","date_gmt":"2023-10-04T13:10:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike"},"modified":"2023-10-04T15:10:15","modified_gmt":"2023-10-04T13:10:16","slug":"v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","title":{"rendered":"Firefox and Cloudflare have enabled ECH support to hide domain names in HTTPS traffic.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Mozilla has announced the inclusion of support for the Encrypted Client Hello (ECH) mechanism in the stable branch of Firefox for users, continuing the development of the Encrypted Server Name Indication (ESNI) technology, which is designed to encrypt information about TLS session parameters, such as the requested domain name. Originally, the code for ECH support was added in Firefox 85 but was disabled by default. In Chrome, support for ECH has been gradually enabled, starting from Chrome 115. <\/p>\n

Since, in addition to connecting with proxy server<\/a> the leakage of information about requested domains occurs through DNS, full protection requires the use of DNS over HTTPS or DNS over TLS to encrypt DNS traffic alongside ECH. Firefox will not use ECH without enabling DNS over HTTPS in the settings. You can check for ECH support in your browser on this page. <\/p>\n

One of the factors that led to the default activation of ECH support in Firefox was Cloudflare's recent integration of ECH support into its content delivery network. Practically speaking, since the data about requested hosts is hidden from analysis when ECH is used, filtering and blocking unwanted sites leveraging Cloudflare's CDN now requires either blocking the entire Cloudflare network, blocking all ECH requests, or intercepting HTTPS with fraudulent root certificates on the user's system. <\/p>\n

Initially, to host multiple HTTPS sites on a single IP address, the TLS extension SNI was used, where the requested host name was included in the ClientHello message sent before establishing a secure communication channel. This feature allowed for distributing requests among virtual hosts at an early stage of connection processing, but it also enabled internet service providers to selectively filter HTTPS traffic and analyze which sites the user is accessing, thus failing to achieve full privacy while using HTTPS. <\/p>\n

To solve this problem and prevent leakage of information about the requested site, the ESNI extension was later proposed, implementing encryption of hostnames. During the implementation of ESNI, it was found that the proposed mechanism does not cover all possible sources of data leakage about the host, and its application is insufficient to ensure full confidentiality of HTTPS sessions. In particular, when resuming a previously established session, the domain name was still openly indicated among the parameters of the TLS PSK (Pre-Shared Key) extension. Furthermore, attempts to implement ESNI revealed compatibility and scalability issues that hindered the widespread adoption of ESNI. <\/p>\n

Considering the identified shortcomings of ESNI, a new universal mechanism called ECH has been developed, allowing for the encryption of parameters for any TLS extensions. Technically, the main difference between ECH and ESNI is that instead of encrypting separate fields, it encrypts the entire ClientHello message at once. ECH implies splitting the ClientHello into two separate messages \u2014 an encrypted message called ClientHelloInner (SNI Inner) and an unencrypted base message referred to as ClientHelloOuter (SNI Outer). In the unencrypted SNI Outer, non-confidential data is transmitted, such as the TLS version and the list of ciphers used, along with a generic domain name that does not overlap with the actual requested domain's name. For instance, for all Cloudflare clients, the unencrypted SNI Outer indicates the common host 'cloudflare-ech.com', while the actual requested host name is sent in the encrypted SNI Inner and is not available for analysis.

\"Firefox<\/center> <\/p>\n

ECH also utilizes a different key distribution scheme for encryption \u2014 the information about the public key is transmitted in HTTPSSVC DNS records, rather than in TXT records. Authenticated end-to-end encryption based on the HPKE (Hybrid Public Key Encryption) mechanism is used to obtain and encrypt the key. ECH further supports secure key retransmission from the server, which can be applied in the case of key rotation. server<\/a> and to solve issues when retrieving outdated keys from the DNS cache.
\n
Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 Firefox \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 ECH (Encrypted Client Hello), \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 ESNI (Encrypted Server Name Indication) \u0438 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043b\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u0445 TLS-\u0441\u0435\u0430\u043d\u0441\u043e\u0432, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a \u0437\u0430\u043f\u0440\u043e\u0448\u0435\u043d\u043d\u043e\u0435 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0435 \u0438\u043c\u044f. \u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043a\u043e\u0434 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 ECH \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u0432 \u0432\u044b\u043f\u0443\u0441\u043a Firefox 85, \u043d\u043e \u0431\u044b\u043b \u043e\u0442\u043a\u043b\u044e\u0447\u0451\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0412 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":110432,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110431","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Firefox and Cloudflare have enabled ECH support to hide the domain in HTTPS traffic | ProHoster","description":"Mozilla has announced the inclusion of ECH (Encrypted Client Hello) support for users of the stable branch of Firefox, continuing the development of the ESNI (Encrypted Server Name Indication) technology.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Firefox \u0438 Cloudflare \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 ECH \u0434\u043b\u044f \u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0434\u043e\u043c\u0435\u043d\u0430 \u0432 HTTPS-\u0442\u0440\u0430\u0444\u0438\u043a\u0435 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 Firefox \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 ECH (Encrypted Client Hello), \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 ESNI (Encrypted Server Name Indication) \u0438.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-04T13:10:16+00:00","article:modified_time":"2023-10-04T13:10:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"110431","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:39:44","updated":"2026-02-09 21:46:41","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/110431","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=110431"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/110431\/revisions"}],"predecessor-version":[{"id":160302,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/110431\/revisions\/160302"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/110432"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=110431"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=110431"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=110431"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}