{"id":110431,"date":"2023-10-04T15:10:15","date_gmt":"2023-10-04T13:10:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike"},"modified":"2023-10-04T15:10:15","modified_gmt":"2023-10-04T13:10:16","slug":"v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","status":"publish","type":"post","link":"https:\/\/prohoster.info\/no\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","title":{"rendered":"I Firefox og Cloudflare er det lagt til st\u00f8tte for ECH for \u00e5 skjule domenet i HTTPS-trafikk","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Mozilla har kunngjort at de har inkludert st\u00f8tte for mekanismen ECH (Encrypted Client Hello) i den stabile versjonen av Firefox, som fortsetter utviklingen av teknologien ESNI (Encrypted Server Name Indication) og er ment for \u00e5 kryptere informasjon om parametrene til TLS-\u00f8kter, slik som det forespurte domenenavnet. Opprinnelig ble koden for \u00e5 h\u00e5ndtere ECH lagt til i utgivelsen av Firefox 85, men den var deaktivert som standard. I Chrome har de begynt \u00e5 gradvis aktivere ECH, med starten fra utgivelsen av Chrome 115. <\/p>\n

Siden det i tillegg til tilkoblingen til serveren<\/a> lekasje av forespurte domenedata skjer gjennom DNS, er det n\u00f8dvendig med bruk av teknologien DNS over HTTPS eller DNS over TLS for \u00e5 kryptere DNS-trafikken for full beskyttelse i tillegg til ECH. Firefox vil ikke bruke ECH uten at DNS over HTTPS er aktivert i innstillingene. Du kan sjekke om ECH er st\u00f8ttet i nettleseren din p\u00e5 denne siden. <\/p>\n

En av faktorene for aktivering av st\u00f8tte for ECH som standard i Firefox, var at Cloudflare for noen dager siden aktiverte st\u00f8tte for ECH i sitt innholdsdistribusjonsnettverk. Praktisk talt, siden data om forespurte verter er skjult fra analyse ved bruk av ECH, vil det n\u00e5 v\u00e6re n\u00f8dvendig \u00e5 blokkere hele Cloudflare-nettverket, blokkere alle foresp\u00f8rsel med ECH, eller organisere avlytting av HTTPS ved hjelp av falske rotsertifikater p\u00e5 brukerens system for \u00e5 filtrere og blokkere u\u00f8nskede nettsteder som bruker Cloudflare CDN. <\/p>\n

Opprinnelig ble TLS-utvidelsen SNI brukt for \u00e5 muliggj\u00f8re drift av flere HTTPS-nettsteder p\u00e5 \u00e9n IP-adresse, der navnet p\u00e5 den forespurte verten ble angitt i ClientHello-meldingen, som ble sendt f\u00f8r opprettelsen av den krypterte kommunikasjonskanalen. Denne funksjonen ga mulighet til \u00e5 fordele foresp\u00f8rslene blant virtuelle verter p\u00e5 et tidlig stadium av tilkoblingsbehandlingen, men tillot ogs\u00e5 internettleverand\u00f8ren \u00e5 selektivt filtrere HTTPS-trafikk og analysere hvilke nettsteder brukeren bes\u00f8ker, noe som ikke ga full konfidensialitet ved bruk av HTTPS. <\/p>\n

For addressing this issue and preventing leakage of information regarding the requested site, the ESNI extension was later proposed, which implements encryption of data including the hostname. During the deployment of ESNI, it was discovered that the proposed mechanism does not cover all possible sources of data leakage about the host, and its application is insufficient for ensuring complete confidentiality of HTTPS sessions. In particular, when resuming a previously established session, the domain name was still indicated in plain text among the parameters of the TLS extension PSK (Pre-Shared Key). Moreover, attempts to implement ESNI revealed compatibility and scalability problems that hindered its widespread adoption. <\/p>\n

Med tanke p\u00e5 de avdekkede manglene ble det utviklet en ny universell mekanisme ECH, som tillater kryptering av parametere i enhver TLS-utvidelse. Teknisk sett er den viktigste forskjellen mellom ECH og ESNI at hele meldingen ClientHello krypteres i stedet for separate felt. ECH forutsetter deling av ClientHello i to separate meldinger \u2014 den krypterte meldingen ClientHelloInner (SNI Inner) og den ukrypterte grunnleggende meldingen ClientHelloOuter (SNI Outer). Den ukrypterte SNI Outer overf\u00f8rer ikke-konfidensielle data, som TLS-versjonen og listen over brukte krypteringsmetoder, samt det generelle domenenavnet, som ikke overlapper med det faktiske navnet p\u00e5 det forespurte domenet. For alle Cloudflare-kunder angis det generelle vertnavnet \u00abcloudflare-ech.com\u00bb i den ukrypterte SNI Outer, mens det faktiske navnet p\u00e5 den forespurte verten overf\u00f8res i den krypterte SNI Inner og ikke er tilgjengelig for analyse.

\"I<\/center> <\/p>\n

ECH bruker ogs\u00e5 en annen n\u00f8kkeldistribusjonsskjema for kryptering \u2014 informasjon om den offentlige n\u00f8kkelen overf\u00f8res i DNS-poster med HTTPSSVC, ikke i poster av typen TXT. For \u00e5 oppn\u00e5 og kryptere n\u00f8kkelen brukes autentisert ende-til-ende-kryptering basert p\u00e5 HPKE-mekanismen (Hybrid Public Key Encryption). ECH st\u00f8tter ogs\u00e5 sikker tilbakef\u00f8ring av n\u00f8kkelen fra serveren, noe som kan brukes ved rotering av n\u00f8kler. serveren<\/a> and for addressing issues when retrieving outdated keys from the DNS cache.
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 Firefox \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 ECH (Encrypted Client Hello), \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 ESNI (Encrypted Server Name Indication) \u0438 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043b\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u0445 TLS-\u0441\u0435\u0430\u043d\u0441\u043e\u0432, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a \u0437\u0430\u043f\u0440\u043e\u0448\u0435\u043d\u043d\u043e\u0435 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0435 \u0438\u043c\u044f. \u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043a\u043e\u0434 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 ECH \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u0432 \u0432\u044b\u043f\u0443\u0441\u043a Firefox 85, \u043d\u043e \u0431\u044b\u043b \u043e\u0442\u043a\u043b\u044e\u0447\u0451\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0412 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":110432,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110431","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47I Firefox og Cloudflare har st\u00f8tte for ECH for \u00e5 skjule domenet i HTTPS-trafikk | ProHoster","description":"Mozilla announced the inclusion of support for the ECH (Encrypted Client Hello) mechanism for users of the stable branch of Firefox, continuing the development of the ESNI (Encrypted Server Name Indication) technology.","canonical_url":"https:\/\/prohoster.info\/no\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nn_NO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Firefox \u0438 Cloudflare \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 ECH \u0434\u043b\u044f \u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0434\u043e\u043c\u0435\u043d\u0430 \u0432 HTTPS-\u0442\u0440\u0430\u0444\u0438\u043a\u0435 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 Firefox \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 ECH (Encrypted Client Hello), \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 ESNI (Encrypted Server Name Indication) \u0438.","og:url":"https:\/\/prohoster.info\/no\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-04T13:10:16+00:00","article:modified_time":"2023-10-04T13:10:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"110431","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:39:44","updated":"2026-02-09 21:46:41","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts\/110431","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/comments?post=110431"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts\/110431\/revisions"}],"predecessor-version":[{"id":160302,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts\/110431\/revisions\/160302"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/media\/110432"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/media?parent=110431"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/categories?post=110431"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/tags?post=110431"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}