{"id":110431,"date":"2023-10-04T15:10:15","date_gmt":"2023-10-04T13:10:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike"},"modified":"2023-10-04T15:10:15","modified_gmt":"2023-10-04T13:10:16","slug":"v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","title":{"rendered":"Podr\u0161ka za ECH koja skriva domenu u HTTPS prometu uklju\u010dena je u Firefox i Cloudflare","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Tvrtka Mozilla najavila je uklju\u010divanje podr\u0161ke za mehanizam ECH (Encrypted Client Hello) za korisnike stabilne verzije preglednika Firefox, nastavljaju\u0107i razvoj tehnologije ESNI (Encrypted Server Name Indication) i osmi\u0161ljenog za \u0161ifriranje informacija o parametrima TLS sesija, poput tra\u017eenog imena domene. Izvorno, kod za rad s ECH bio je dodan u verziju Firefox 85, ali je bio onemogu\u0107en prema zadanim postavkama. U Chromeu su podr\u0161ku za ECH po\u010deli postupno uklju\u010divati od izdanja Chrome 115. <\/p>\n

Budu\u0107i da se osim povezivanja s serverom<\/a> curenje informacija o tra\u017eenim domenama doga\u0111a putem DNS-a, za potpunu za\u0161titu osim ECH potrebno je koristiti tehnologiju DNS over HTTPS ili DNS over TLS za \u0161ifriranje DNS prometa. Firefox ne\u0107e koristiti ECH bez uklju\u010divanja DNS over HTTPS u postavkama. Provjeru podr\u0161ke za ECH u pregledniku mo\u017eete izvr\u0161iti na ovoj stranici. <\/p>\n

Jedan od faktora za aktivaciju podr\u0161ke ECH u Firefoxu postalo je uklju\u010divanje podr\u0161ke ECH u mre\u017ei za isporuku sadr\u017eaja od strane tvrtke Cloudflare prije nekoliko dana. S prakti\u010dne strane, budu\u0107i da su podaci o tra\u017eenim hostovima pri kori\u0161tenju ECH sakriveni od analize, za filtriranje i blokiranje neugodnih web stranica koje koriste CDN Cloudflare, sada \u0107e biti potrebno blokirati cijelu mre\u017eu Cloudflare, blokirati sve zahtjeve s ECH ili organizirati presretanje HTTPS-a kori\u0161tenjem la\u017enih korijenskih certifikata na korisni\u010dkom sustavu. <\/p>\n

Izvorno, za omogu\u0107avanje rada vi\u0161e HTTPS web stranica na jednoj IP adresi kori\u0161teno je TLS pro\u0161irenje SNI, pri \u010demu je ime tra\u017eenog hosta navedeno u ClientHello poruci koja se \u0161alje prije uspostavljanja \u0161ifriranog kanala veze. Ova zna\u010dajka omogu\u0107ila je raspodjelu zahtjeva po virtualnim hostovima u ranom stadiju obrade veze, ali je tako\u0111er omogu\u0107ila pru\u017eatelju internetskih usluga selektivno filtriranje HTTPS prometa i analizu kojih web stranica korisnici otvaraju, \u0161to nije omogu\u0107ilo postizanje potpune privatnosti pri kori\u0161tenju HTTPS-a. <\/p>\n

Kako bi se rije\u0161io ovaj problem i sprije\u010dilo curenje informacija o tra\u017eenom web mjestu, kasnije je predlo\u017eeno pro\u0161irenje ESNI koje implementira enkripciju podataka imenom doma\u0107ina. Tijekom implementacije ESNI otkriveno je da predlo\u017eeni mehanizam ne pokriva sve mogu\u0107e izvore curenja informacija o hostu, a njegova primjena nije dovoljna za osiguranje potpune privatnosti HTTPS sesija. Konkretno, prilikom obnavljanja prethodno uspostavljene sesije, ime domene je u ne\u0161ifriranom obliku i dalje bilo navedeno me\u0111u parametrima TLS pro\u0161irenja PSK (Pre-Shared Key). Osim toga, poku\u0161aji implementacije ESNI otkrili su probleme s kompatibilno\u0161\u0107u i skalabilno\u0161\u0107u koji su ometali \u0161iroku primjenu ESNI. <\/p>\n

Uzimaju\u0107i u obzir uo\u010dene nedostatke, ESNI je razvijen novi univerzalni mehanizam ECH, koji omogu\u0107uje \u0161ifriranje parametara bilo kojih TLS ekstenzija. Tehni\u010dki, glavna razlika izme\u0111u ECH-a i ESNI-a je ta \u0161to se umjesto odvojenih polja \u0161ifrira poruka ClientHello u cjelini. ECH podrazumijeva razdvajanje ClientHello na dvije odvojene poruke \u2014 \u0161ifriranu poruku ClientHelloInner (SNI Inner) i ne\u0161ifriranu osnovnu poruku ClientHelloOuter (SNI Outer). U ne\u0161ifriranom SNI Outer prenose se neosjetljivi podaci, kao \u0161to su verzija TLS-a i popis kori\u0161tenih \u0161ifri, kao i zajedni\u010dko ime domene koje se ne poklapa sa stvarnim imenom zatra\u017eene domene. Na primjer, za sve klijente Cloudflare u ne\u0161ifriranom SNI Outer navodi se zajedni\u010dki host \"cloudflare-ech.com\", dok se stvarno ime zatra\u017eenog hosta prenosi u \u0161ifriranom SNI Inner i nije dostupno za analizu.

\"Podr\u0161ka<\/center> <\/p>\n

ECH tako\u0111er koristi druga\u010diju shemu distribucije klju\u010deva za \u0161ifriranje \u2014 informacije o javnom klju\u010du prenose se u DNS zapisima HTTPSSVC, a ne u zapisima tipa TXT. Za dobivanje i \u0161ifriranje klju\u010da koristi se autentificirana end-to-end \u0161ifriranja na osnovi mehanizma HPKE (Hybrid Public Key Encryption). ECH tako\u0111er podr\u017eava sigurnu ponovnu predaju klju\u010da s poslu\u017eitelja, \u0161to se mo\u017ee primijeniti u slu\u010daju rotacije klju\u010deva. serveru<\/a> i za rje\u0161avanje problema pri dobivanju zastarjelih klju\u010deva iz DNS predmemorije.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 Firefox \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 ECH (Encrypted Client Hello), \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 ESNI (Encrypted Server Name Indication) \u0438 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043b\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u0445 TLS-\u0441\u0435\u0430\u043d\u0441\u043e\u0432, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a \u0437\u0430\u043f\u0440\u043e\u0448\u0435\u043d\u043d\u043e\u0435 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0435 \u0438\u043c\u044f. \u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043a\u043e\u0434 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 ECH \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u0432 \u0432\u044b\u043f\u0443\u0441\u043a Firefox 85, \u043d\u043e \u0431\u044b\u043b \u043e\u0442\u043a\u043b\u044e\u0447\u0451\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0412 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":110432,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110431","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47U Firefoxu i Cloudflareu omogu\u0107ena je podr\u0161ka za ECH za skrivanje domene u HTTPS prometu | ProHoster","description":"Tvrtka Mozilla objavila je uklju\u010divanje podr\u0161ke za mehanizam ECH (Encrypted Client Hello) za korisnike stabilne verzije Firefox, nastavljaju\u0107i razvoj tehnologije ESNI (Encrypted Server Name Indication) i.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Firefox \u0438 Cloudflare \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 ECH \u0434\u043b\u044f \u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0434\u043e\u043c\u0435\u043d\u0430 \u0432 HTTPS-\u0442\u0440\u0430\u0444\u0438\u043a\u0435 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 Firefox \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 ECH (Encrypted Client Hello), \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 ESNI (Encrypted Server Name Indication) \u0438.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-04T13:10:16+00:00","article:modified_time":"2023-10-04T13:10:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"110431","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:39:44","updated":"2026-02-09 21:46:41","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/110431","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=110431"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/110431\/revisions"}],"predecessor-version":[{"id":160302,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/110431\/revisions\/160302"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media\/110432"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=110431"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=110431"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=110431"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}