{"id":110431,"date":"2023-10-04T15:10:15","date_gmt":"2023-10-04T13:10:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike"},"modified":"2023-10-04T15:10:15","modified_gmt":"2023-10-04T13:10:16","slug":"v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","title":{"rendered":"Firefox \u0219i Cloudflare includ suport pentru ECH pentru ascunderea domeniului \u00een traficul HTTPS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Compania Mozilla a anun\u021bat activarea suportului pentru mecanismul ECH (Encrypted Client Hello) \u00een ramura stabil\u0103 a browser-ului Firefox, continu\u00e2nd dezvoltarea tehnologiei ESNI (Encrypted Server Name Indication) \u0219i av\u00e2nd ca scop criptarea informa\u021biilor despre parametrii sesiunilor TLS, cum ar fi numele de domeniu solicitat. Ini\u021bial, codul pentru func\u021bionarea ECH a fost ad\u0103ugat \u00een versiunea Firefox 85, dar a fost dezactivat implicit. \u00cen Chrome, suportul pentru ECH a \u00eenceput s\u0103 fie activat treptat, \u00eencep\u00e2nd cu versiunea Chrome 115. <\/p>\n

\u00centruc\u00e2t, pe l\u00e2ng\u0103 conectarea la serverul<\/a> scurgerile de informa\u021bii despre domeniile solicitate se realizeaz\u0103 prin DNS, pentru o protec\u021bie complet\u0103, pe l\u00e2ng\u0103 ECH, este necesar\u0103 implementarea tehnologiei DNS over HTTPS sau DNS over TLS pentru criptarea traficului DNS. Firefox nu va utiliza ECH f\u0103r\u0103 activarea DNS over HTTPS \u00een set\u0103ri. Verifica\u021bi suportul pentru ECH \u00een browser pe aceast\u0103 pagin\u0103. <\/p>\n

Unul dintre factorii activ\u0103rii automate a suportului ECH \u00een Firefox a fost includerea, cu c\u00e2teva zile \u00een urm\u0103, de c\u0103tre compania Cloudflare, a suportului ECH \u00een re\u021beaua sa de livrare a con\u021binutului. Din punct de vedere practic, av\u00e2nd \u00een vedere c\u0103 informa\u021biile despre gazdele solicitate sunt ascunse de analiza ECH, pentru filtrarea \u0219i blocarea site-urilor necorespunz\u0103toare care utilizeaz\u0103 CDN Cloudflare, va fi necesar\u0103 blocarea \u00eentregii re\u021bele Cloudflare, blocarea tuturor cererilor cu ECH sau organizarea intercept\u0103rii HTTPS cu ajutorul certificatelor r\u0103d\u0103cin\u0103 false pe sistemul utilizatorului. <\/p>\n

Ini\u021bial, pentru a organiza func\u021bionarea mai multor site-uri HTTPS pe aceea\u0219i adres\u0103 IP, s-a folosit extensia TLS SNI, prin care numele gazdei solicitate era specificat \u00een mesajul ClientHello, trimis \u00eenainte de stabilirea canalului de comunica\u021bie criptat. Aceast\u0103 caracteristic\u0103 permitea, \u00een etapa incipient\u0103 a proces\u0103rii conexiunii, distribuirea cererilor \u00eentre gazdele virtuale, dar permitea, de asemenea, pe partea furnizorului de internet, filtrarea selectiv\u0103 a traficului HTTPS \u0219i analiza site-urilor pe care le deschide utilizatorul, ceea ce \u00eempiedica ob\u021binerea unei confiden\u021bialit\u0103\u021bi complete \u00een cadrul HTTPS. <\/p>\n

Pentru a rezolva aceast\u0103 problem\u0103 \u0219i a evita scurgerile de informa\u021bii despre site-ul solicitat, a fost propus ulterior extensia ESNI, care implementeaz\u0103 criptarea datelor cu numele gazdelor. \u00cen procesul de implementare a ESNI, s-a constatat c\u0103 mecanismul propus nu acoper\u0103 toate sursele posibile de scurgere a datelor despre gazd\u0103 \u0219i utilizarea sa este insuficient\u0103 pentru a asigura confiden\u021bialitatea complet\u0103 a sesiunilor HTTPS. \u00cen special, la reluarea unei sesiuni pre\u00eent\u00e2mpinate, numele domeniului era \u00een continuare transmis deschis \u00een cadrul parametrilor extensiei TLS PSK (Pre-Shared Key). De asemenea, \u00eencerc\u0103rile de implementare a ESNI au relevat probleme de compatibilitate \u0219i scalabilitate, care au \u00eempiedicat r\u0103sp\u00e2ndirea generalizat\u0103 a ESNI. <\/p>\n

Av\u00e2nd \u00een vedere deficien\u021bele identificate, a fost dezvoltat un nou mecanism universal ECH, care permite criptarea parametrilor oric\u0103ror extensii TLS. Tehnic, principala diferen\u021b\u0103 dintre ECH \u0219i ESNI este c\u0103, \u00een loc de c\u00e2mpuri separate, se cripteaz\u0103 \u00eentreaga mesaj ClientHello. ECH presupune \u00eemp\u0103r\u021birea mesajului ClientHello \u00een dou\u0103 mesaje separate \u2013 mesajul criptat ClientHelloInner (SNI Inner) \u0219i mesajul de baz\u0103 necriptat ClientHelloOuter (SNI Outer). \u00cen SNI Outer necriptat, sunt transmise date care nu afecteaz\u0103 confiden\u021bialitatea, cum ar fi versiunea TLS \u0219i lista de criptare utilizat\u0103, precum \u0219i numele de domeniu general, care nu se suprapune cu numele efectiv al domeniului solicitat. De exemplu, pentru to\u021bi clien\u021bii Cloudflare, \u00een SNI Outer necriptat se specific\u0103 gazda comun\u0103 \u201ecloudflare-ech.com\u201d, iar numele efectiv al gazdei solicitate este transmis \u00een SNI Inner criptat \u0219i nu este disponibil pentru analiz\u0103.

\"Firefox<\/center> <\/p>\n

ECH utilizeaz\u0103, de asemenea, o alt\u0103 schem\u0103 de distribu\u021bie a cheii pentru criptare \u2013 informa\u021biile despre cheia public\u0103 sunt transmise \u00een \u00eenregistr\u0103rile DNS HTTPSSVC, \u0219i nu \u00een \u00eenregistr\u0103rile de tip TXT. Pentru ob\u021binerea \u0219i criptarea cheii se aplic\u0103 criptarea end-to-end autenticat\u0103 bazat\u0103 pe mecanismul HPKE (Hybrid Public Key Encryption). ECH suport\u0103, de asemenea, retransmisia sigur\u0103 a cheii de pe server, ceea ce poate fi utilizat \u00een cazul rota\u021biei cheilor. server<\/a> \u0219i pentru a rezolva problemele la ob\u021binerea cheilor \u00eenvechite din cache-ul DNS.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 Firefox \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 ECH (Encrypted Client Hello), \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 ESNI (Encrypted Server Name Indication) \u0438 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043b\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u0445 TLS-\u0441\u0435\u0430\u043d\u0441\u043e\u0432, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a \u0437\u0430\u043f\u0440\u043e\u0448\u0435\u043d\u043d\u043e\u0435 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0435 \u0438\u043c\u044f. \u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043a\u043e\u0434 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 ECH \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u0432 \u0432\u044b\u043f\u0443\u0441\u043a Firefox 85, \u043d\u043e \u0431\u044b\u043b \u043e\u0442\u043a\u043b\u044e\u0447\u0451\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0412 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":110432,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110431","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Firefox \u0219i Cloudflare au activat suportul ECH pentru ascunderea domeniului \u00een traficul HTTPS | ProHoster","description":"Compania Mozilla a anun\u021bat activarea pentru utilizatorii versiunii stabile Firefox a suportului pentru mecanismul ECH (Encrypted Client Hello), continu\u00e2nd dezvoltarea tehnologiei ESNI (Encrypted Server Name Indication) \u0219i.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Firefox \u0438 Cloudflare \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 ECH \u0434\u043b\u044f \u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0434\u043e\u043c\u0435\u043d\u0430 \u0432 HTTPS-\u0442\u0440\u0430\u0444\u0438\u043a\u0435 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 Firefox \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 ECH (Encrypted Client Hello), \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 ESNI (Encrypted Server Name Indication) \u0438.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-04T13:10:16+00:00","article:modified_time":"2023-10-04T13:10:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"110431","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:39:44","updated":"2026-02-09 21:46:41","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/110431","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=110431"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/110431\/revisions"}],"predecessor-version":[{"id":160302,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/110431\/revisions\/160302"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/110432"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=110431"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=110431"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=110431"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}