{"id":110431,"date":"2023-10-04T15:10:15","date_gmt":"2023-10-04T13:10:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike"},"modified":"2023-10-04T15:10:15","modified_gmt":"2023-10-04T13:10:16","slug":"v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","title":{"rendered":"Firefoxis ja Cloudflare'is on aktiveeritud ECH toetus HTTPS-liikluses domeeni varjamiseks.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Mozilla teatas, et Firefoxi stabiilse haru kasutajatele on aktiveeritud ECH (Encrypted Client Hello) mehhanismi tugi, mis j\u00e4tkab ESNI (Encrypted Server Name Indication) tehnoloogia arengut ja on m\u00f5eldud TLS-seansside parameetrite (nt n\u00f5utava domeeninime) teabe kr\u00fcpteerimiseks. ECH toega t\u00f6\u00f6tamise kood lisati algselt Firefoxi versiooni 85, kuid see oli vaikimisi keelatud. Chromes hakati ECH tuge j\u00e4rk-j\u00e4rgult lubama alates versioonist Chrome 115. <\/p>\n

Kuna domeeninimede kohta saadetud teave lekib l\u00e4bi DNS-i, on ECH t\u00e4ielikuks kaitseks vajalik rakendada DNS over HTTPS v\u00f5i DNS over TLS tehnoloogiat DNS-liikluse kr\u00fcpteerimiseks. Firefox ei kasuta ECH-d, kui DNS over HTTPS seadistustes ei ole lubatud. ECH-i toimet kontrollimiseks brauseris saab k\u00fclastada seda lehte. serverilt<\/a> Ehitus, mis lubab ECH tuge, saidi \u00fchendamisel Cloudflare'i, on oluline, et DNS-i info piirdub s\u00f5numitega, mis on rakendamisel kehtestatud. <\/p>\n

\u00dcks p\u00f5hjusi, miks ECH toetus Firefoxis vaikimisi aktiveeriti, oli Cloudflare'i otsus, mis tehti paar p\u00e4eva tagasi, et aktiveerida ECH oma sisuhaldusv\u00f5rgus. Praktikas, kuna n\u00f5utud hostide andmed on ECH kasutamisel anal\u00fc\u00fcsimiseks varjatud, siis sobivatele saitidele juurdep\u00e4\u00e4su filtreerimiseks ja blokeerimiseks, mis kasutavad Cloudflare'i CDN-i, on n\u00fc\u00fcd vajalik kas tervet Cloudflare'i v\u00f5rku blokeerida, k\u00f5ik ECH-i p\u00e4ringud blokeerida v\u00f5i korraldada HTTPS-i pealtkuulamine valejuursertifikaatide abil kasutaja s\u00fcsteemis. <\/p>\n

Alguses kasutati sama IP-aadressi all mitme HTTPS-saiti korraldamiseks TLS-i laiendust SNI, kus n\u00f5utud hosti nimi oli m\u00e4rgitud ClientHello s\u00f5numis, mis edastati enne kr\u00fcpteeritud andmekanali loomist. See omadus v\u00f5imaldas varasema etapis \u00fchenduse t\u00f6\u00f6tlemist jaotus- ning anal\u00fc\u00fcsida, milliseid saite kasutaja avab, mis ei v\u00f5imaldanud saavutada t\u00e4ielikku konfidentsiaalsust HTTPS-i kasutamisel. <\/p>\n

K\u00e4esoleva probleemi lahendamiseks ja n\u00f5utud veebisaidi teabe leketeksi v\u00e4ltimiseks pakuti hiljem v\u00e4lja ESNI laiendus, mis rakendab hostinime andmete kr\u00fcpteerimist. ESNI rakendamise protsessis selgus, et pakutud mehhanism ei kata k\u00f5iki v\u00f5imalikke andmeleketallikaid hostist ning selle rakendamine ei ole piisav HTTPS seansside t\u00e4ieliku konfidentsiaalsuse tagamiseks. Eelk\u00f5ige varasemalt loodud seansi taastamisel j\u00e4tkus domeeninime edastamine selgesti TLS-i laieharudega PSK (Eelnevalt jagatud v\u00f5tme) parameetrites. Lisaks t\u00f5id ESNI rakendamise katsed esile \u00fchilduvuse ja skaleeritavuse probleemid, mis takistasid ESNI ulatuslikku levikut. <\/p>\n

ESNI puuduste arvestamisel on loodud uus universaalne mehhanism ECH, mis v\u00f5imaldab \u0161ifreerida k\u00f5igi TLS-i laienduste parameetreid. Tehniliselt on ECH peamine erinevus ESNI-st selles, et eraldi v\u00e4ljade asemel \u0161ifreeritakse kohe kogu ClientHello s\u00f5num. ECH eeldab, et ClientHello jagatakse kaheks eraldi s\u00f5numiks \u2014 \u0161ifreeritud s\u00f5num ClientHelloInner (SNI Inner) ja \u0161ifreerimata p\u00f5hisisu ClientHelloOuter (SNI Outer). \u0160ifreerimata SNI Outer edastab konfidentsiaalsust mittepuutuvad andmed, nagu TLS-i versioon ja kasutatavate \u0161ifrimine nimekiri, samuti \u00fcldine domeeninimi, mis ei kattu tegeliku taotletud domeeninimega. N\u00e4iteks edastatakse k\u00f5igi Cloudflare'i klientide jaoks \u0161ifreerimata SNI Outer'is \u00fcldine host 'cloudflare-ech.com', samas kui tegelik taotletud hosti nimi edastatakse \u0161ifreeritud SNI Inner'is ja ei ole anal\u00fc\u00fcsimiseks saadaval.

\"Firefoxis<\/center> <\/p>\n

ECH kasutab samuti teistsugust v\u00f5tme jaotamise skeemi \u0161ifreerimise jaoks \u2014 teave avaliku v\u00f5tme kohta edastatakse DNS-i kirjetes HTTPSSVC, mitte TXT t\u00fc\u00fcpi kirjetes. V\u00f5tme saamiseks ja \u0161ifreerimiseks kasutatakse autentitud l\u00f5pust l\u00f5puni \u0161ifreerimist HPKE (H\u00fcbriidne Avaliku V\u00f5tme \u0160ifreerimine) mehhanismi p\u00f5hjal. ECH toetab ka v\u00f5tme turvalist edasil\u00fckkamist serverilt, mida v\u00f5ib kasutada v\u00f5tmete vahetamisel. serveris<\/a> ja probleemide lahendamiseks vanade v\u00f5tmete saamisel DNS-i vahem\u00e4lust.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 Firefox \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 ECH (Encrypted Client Hello), \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 ESNI (Encrypted Server Name Indication) \u0438 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043b\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u0445 TLS-\u0441\u0435\u0430\u043d\u0441\u043e\u0432, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a \u0437\u0430\u043f\u0440\u043e\u0448\u0435\u043d\u043d\u043e\u0435 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0435 \u0438\u043c\u044f. \u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043a\u043e\u0434 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 ECH \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u0432 \u0432\u044b\u043f\u0443\u0441\u043a Firefox 85, \u043d\u043e \u0431\u044b\u043b \u043e\u0442\u043a\u043b\u044e\u0447\u0451\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0412 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":110432,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110431","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Firefoxi ja Cloudflare'i poolt on sisse l\u00fclitatud ECH-tugi, et peita domeeni HTTPS-i liikluses | ProHoster","description":"Mozilla kuulutas v\u00e4lja toetuse ECH (Encrypted Client Hello) mehhanismile stabiilses Firefoxi harus, mis j\u00e4tkab ESNI (Encrypted Server Name Indication) tehnoloogia arendamist.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Firefox \u0438 Cloudflare \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 ECH \u0434\u043b\u044f \u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0434\u043e\u043c\u0435\u043d\u0430 \u0432 HTTPS-\u0442\u0440\u0430\u0444\u0438\u043a\u0435 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 Firefox \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 ECH (Encrypted Client Hello), \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 ESNI (Encrypted Server Name Indication) \u0438.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-04T13:10:16+00:00","article:modified_time":"2023-10-04T13:10:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"110431","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:39:44","updated":"2026-02-09 21:46:41","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/110431","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=110431"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/110431\/revisions"}],"predecessor-version":[{"id":160302,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/110431\/revisions\/160302"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/110432"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=110431"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=110431"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=110431"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}