{"id":110431,"date":"2023-10-04T15:10:15","date_gmt":"2023-10-04T13:10:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike"},"modified":"2023-10-04T15:10:15","modified_gmt":"2023-10-04T13:10:16","slug":"v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","title":{"rendered":"Firefox un Cloudflare ir aktiviz\u0113ju\u0161i ECH atbalstu, lai sl\u0113ptu dom\u0113nu HTTPS satiksm\u0113.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Mozilla uz\u0146\u0113mums pazi\u0146oja par Encrypted Client Hello (ECH) atbalsta iek\u013cau\u0161anu Firefox stabilaj\u0101 versij\u0101, turpinot att\u012bst\u012bt ESNI (Encrypted Server Name Indication) tehnolo\u0123iju, kas paredz\u0113ta TLS sesiju parametru, piem\u0113ram, piepras\u012bt\u0101 dom\u0113na nosaukuma, inform\u0101cijas \u0161ifr\u0113\u0161anai. S\u0101kotn\u0113ji kods darbam ar ECH tika pievienots Firefox 85 izlaidum\u0101, bet tas tika atsl\u0113gts noklus\u0113jum\u0101. Chrome ECH atbalstu s\u0101ka pak\u0101peniski iek\u013caut, s\u0101kot no Chrome 115 izlaiduma. <\/p>\n

T\u0101 k\u0101, papildus savienojumam ar serveri<\/a> inform\u0101cijas nopl\u016bde par piepras\u012btajiem dom\u0113niem notiek caur DNS, lai nodro\u0161in\u0101tu piln\u012bgu aizsardz\u012bbu, papildus ECH ir nepiecie\u0161ams izmantot DNS over HTTPS vai DNS over TLS tehnolo\u0123iju DNS trafika \u0161ifr\u0113\u0161anai. Firefox neizmantos ECH, ja DNS over HTTPS nav iesl\u0113gts iestat\u012bjumos. P\u0101rbaud\u012bt ECH atbalstu p\u0101rl\u016bk\u0101 var \u0161aj\u0101 lap\u0101. <\/p>\n

Viens no faktoriem, kas veicin\u0101ja ECH atbalsta noklus\u0113juma aktiviz\u0113\u0161anu Firefox, bija Cloudflare uz\u0146\u0113muma atbalsta ECH iek\u013cau\u0161ana sav\u0101 satura pieg\u0101des t\u012bkl\u0101 pirms da\u017e\u0101m dien\u0101m. Praktisk\u0101 noz\u012bm\u0113, t\u0101 k\u0101 dati par piepras\u012btajiem hostiem, izmantojot ECH, ir sl\u0113pti no anal\u012bzes, lai filtr\u0113tu un blo\u0137\u0113tu nev\u0113lam\u0101s vietnes, kas izmanto Cloudflare CDN, tagad b\u016bs nepiecie\u0161ams blo\u0137\u0113t visu Cloudflare t\u012bklu, blo\u0137\u0113t visus piepras\u012bjumus ar ECH vai organiz\u0113t HTTPS uztver\u0161anu, izmantojot nepatiesus saknes sertifik\u0101tus lietot\u0101ja sist\u0113m\u0101. <\/p>\n

S\u0101kotn\u0113ji, lai nodro\u0161in\u0101tu vair\u0101ku HTTPS viet\u0146u darb\u012bbu vien\u0101 IP adres\u0113, tika izmantota TLS papla\u0161in\u0101juma SNI tehnolo\u0123ija, kur piepras\u012bt\u0101 hosta nosaukums tika nor\u0101d\u012bts ClientHello zi\u0146ojum\u0101, kas tika nos\u016bt\u012bts pirms \u0161ifr\u0113t\u0101 sakaru kan\u0101la izveides. \u0160\u012b iez\u012bme \u013c\u0101va agr\u012bnaj\u0101 savienojuma apstr\u0101des posm\u0101 sadal\u012bt piepras\u012bjumus pa virtu\u0101lajiem hostiem, bet ar\u012b \u013c\u0101va interneta pakalpojumu sniedz\u0113jiem selekt\u012bvi filtr\u0113t HTTPS trafiku un analiz\u0113t, kuras vietnes lietot\u0101js apmekl\u0113, kas ne\u013c\u0101va sasniegt piln\u012bgu konfidencialit\u0101ti, izmantojot HTTPS. <\/p>\n

Lai risin\u0101tu \u0161o probl\u0113mu un nov\u0113rstu inform\u0101cijas nopl\u016bdi par piepras\u012bto vietni, v\u0113l\u0101k tika pied\u0101v\u0101ta ESNI papla\u0161in\u0101juma ievie\u0161ana, kas \u012bsteno datu \u0161ifr\u0113\u0161anu ar hosta v\u0101rdu. Ievie\u0161anas proces\u0101 tika apstiprin\u0101ts, ka ierosin\u0101tais meh\u0101nisms neaptver visus iesp\u0113jam\u0101s inform\u0101cijas nopl\u016bdes avotus par hostu un t\u0101 pielietojums nav pietiekams, lai nodro\u0161in\u0101tu piln\u012bgu HTTPS sesiju konfidencialit\u0101ti. \u012apa\u0161i \u2013 atjaunojot iepriek\u0161 izveidoto sesiju, dom\u0113na v\u0101rds atkl\u0101ti joproj\u0101m tika nor\u0101d\u012bts TLS papla\u0161in\u0101juma PSK (Pre-Shared Key) parametru skait\u0101. Turkl\u0101t m\u0113\u0123in\u0101jumi ieviest ESNI atkl\u0101ja sader\u012bbas un m\u0113rogojam\u012bbas probl\u0113mas, kas trauc\u0113ja ESNI izplat\u012b\u0161anu. <\/p>\n

\u0145emot v\u0113r\u0101 identific\u0113t\u0101s probl\u0113mas, ESNI tika izstr\u0101d\u0101ts jauns univers\u0101ls meh\u0101nisms ECH, kas at\u013cauj \u0161ifr\u0113t jebkura TLS papla\u0161in\u0101juma parametrus. Tehniski galven\u0101 at\u0161\u0137ir\u012bba ECH no ESNI ir t\u0101da, ka tiek \u0161ifr\u0113ta visa ClientHello zi\u0146a, nevis atsevi\u0161\u0137i lauki. ECH paredz sadal\u012bt ClientHello div\u0101s atsevi\u0161\u0137\u0101s zi\u0146\u0101s \u2014 \u0161ifr\u0113taj\u0101 zi\u0146\u0101 ClientHelloInner (SNI Inner) un ne\u0161ifr\u0113taj\u0101 pamatzi\u0146\u0101 ClientHelloOuter (SNI Outer). Ne\u0161ifr\u0113taj\u0101 SNI Outer tiek p\u0101rs\u016bt\u012bti datus, kas neietekm\u0113 konfidencialit\u0101ti, piem\u0113ram, TLS versija un izmantoto \u0161ifru saraksts, k\u0101 ar\u012b kop\u0113jais dom\u0113na v\u0101rds, kas nesakr\u012bt ar re\u0101li piepras\u012bt\u0101 dom\u0113na nosaukumu. Piem\u0113ram, visiem Cloudflare klientiem ne\u0161ifr\u0113taj\u0101 SNI Outer tiek nor\u0101d\u012bts kop\u012bgais hostings \u201ecloudflare-ech.com\u201d, bet re\u0101lais piepras\u012bt\u0101 hosta nosaukums tiek nos\u016bt\u012bts \u0161ifr\u0113taj\u0101 SNI Inner un nav pieejams anal\u012bzei.

\"Firefox<\/center> <\/p>\n

ECH ar\u012b izmanto citu atsl\u0113gas izplat\u012b\u0161anas sh\u0113mu \u0161ifr\u0113\u0161anai \u2014 inform\u0101cija par publisko atsl\u0113gu tiek nos\u016bt\u012bta DNS ierakstos HTTPSSVC, nevis TXT ierakstos. Atsl\u0113gas ieg\u016b\u0161anai un \u0161ifr\u0113\u0161anai tiek izmantota autentific\u0113ta galven\u0101 \u0161ifr\u0113\u0161ana, kas balst\u012bta uz HPKE (Hibr\u012bd\u0101 Publisk\u0101 Atsl\u0113gas \u0160ifr\u0113\u0161ana) meh\u0101nismu. ECH ar\u012b atbalsta dro\u0161u atsl\u0113gas atk\u0101rtotu p\u0101rs\u016bt\u012b\u0161anu no servera, ko var izmantot atsl\u0113gu rot\u0101cijas gad\u012bjum\u0101. serveri<\/a> un lai risin\u0101tu probl\u0113mas ar novecoju\u0161u atsl\u0113gu ieg\u016b\u0161anu no DNS ke\u0161a.
\n
Avots: opennet.lv<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 Firefox \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 ECH (Encrypted Client Hello), \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 ESNI (Encrypted Server Name Indication) \u0438 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043b\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u0445 TLS-\u0441\u0435\u0430\u043d\u0441\u043e\u0432, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a \u0437\u0430\u043f\u0440\u043e\u0448\u0435\u043d\u043d\u043e\u0435 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0435 \u0438\u043c\u044f. \u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043a\u043e\u0434 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 ECH \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u0432 \u0432\u044b\u043f\u0443\u0441\u043a Firefox 85, \u043d\u043e \u0431\u044b\u043b \u043e\u0442\u043a\u043b\u044e\u0447\u0451\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0412 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":110432,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110431","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Firefox un Cloudflare ir aktiviz\u0113ta ECH atbalsts dom\u0113na sl\u0113p\u0161anai HTTPS satiksm\u0113 | ProHoster","description":"Uz\u0146\u0113mums Mozilla pazi\u0146oja par ECH (Encrypted Client Hello) meh\u0101nisma atbalsta iek\u013cau\u0161anu stabil\u0101s Firefox versijas lietot\u0101jiem, turpinot ESNI (Encrypted Server Name Indication) tehnolo\u0123ijas att\u012bst\u012bbu.","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Firefox \u0438 Cloudflare \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 ECH \u0434\u043b\u044f \u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0434\u043e\u043c\u0435\u043d\u0430 \u0432 HTTPS-\u0442\u0440\u0430\u0444\u0438\u043a\u0435 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 Firefox \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 ECH (Encrypted Client Hello), \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 ESNI (Encrypted Server Name Indication) \u0438.","og:url":"https:\/\/prohoster.info\/lv\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-04T13:10:16+00:00","article:modified_time":"2023-10-04T13:10:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"110431","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:39:44","updated":"2026-02-09 21:46:41","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/110431","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=110431"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/110431\/revisions"}],"predecessor-version":[{"id":160302,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/110431\/revisions\/160302"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media\/110432"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=110431"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=110431"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=110431"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}