{"id":110431,"date":"2023-10-04T15:10:15","date_gmt":"2023-10-04T13:10:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike"},"modified":"2023-10-04T15:10:15","modified_gmt":"2023-10-04T13:10:16","slug":"v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","title":{"rendered":"Vo Firefoxe a Cloudflare je zapnut\u00e1 podpora ECH na skrytie dom\u00e9ny v HTTPS prev\u00e1dzke","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Spolo\u010dnos\u0165 Mozilla ozn\u00e1mila zavedenie podpory mechanizmu ECH (Encrypted Client Hello) pre pou\u017e\u00edvate\u013eov stabilnej verzie Firefox, ktor\u00fd pokra\u010duje v rozvoji technol\u00f3gie ESNI (Encrypted Server Name Indication) a je ur\u010den\u00fd na \u0161ifrovanie inform\u00e1ci\u00ed o parametroch TLS rel\u00e1ci\u00ed, ako je po\u017eadovan\u00e9 dom\u00e9nov\u00e9 meno. K\u00f3d pre pr\u00e1cu s ECH bol p\u00f4vodne pridan\u00fd do verzie Firefox 85, av\u0161ak bol predvolene vypnut\u00fd. V Chrome za\u010dali s postupn\u00fdm zap\u00ednan\u00edm podpory ECH od verzie Chrome 115. <\/p>\n

Ke\u010f\u017ee okrem pripojenia s serverom<\/a> \u00fanik inform\u00e1ci\u00ed o po\u017eadovan\u00fdch dom\u00e9nach nast\u00e1va cez DNS, pre komplexn\u00fa ochranu je okrem ECH potrebn\u00e9 aj pou\u017eitie technol\u00f3gie DNS over HTTPS alebo DNS over TLS na \u0161ifrovanie DNS prev\u00e1dzky. Firefox nebude pou\u017e\u00edva\u0165 ECH bez zapnutia DNS over HTTPS v nastaveniach. Skontrolova\u0165 podporu ECH v prehliada\u010di m\u00f4\u017eete na tejto str\u00e1nke. <\/p>\n

Jedn\u00fdm z faktorov, ktor\u00e9 viedli k predvolen\u00e9mu zapnutiu podpory ECH vo Firefoxe, bolo ned\u00e1vne zapnutie podpory ECH v sieti Cloudflare na doru\u010dovanie obsahu. Z praktick\u00e9ho h\u013eadiska, ke\u010f\u017ee \u00fadaje o po\u017eadovan\u00fdch hostite\u013eoch s\u00fa pri pou\u017eit\u00ed ECH skryt\u00e9 pred anal\u00fdzou, pre filtrovanie a blokovanie ne\u017eiaducich str\u00e1nok, ktor\u00e9 pou\u017e\u00edvaj\u00fa Cloudflare CDN, bude teraz potrebn\u00e9 blokova\u0165 cel\u00fa sie\u0165 Cloudflare, blokova\u0165 v\u0161etky po\u017eiadavky s ECH alebo organizova\u0165 zachyt\u00e1vanie HTTPS pomocou podvodn\u00fdch kore\u0148ov\u00fdch certifik\u00e1tov na u\u017e\u00edvate\u013eskom syst\u00e9me. <\/p>\n

P\u00f4vodne na organizovanie fungovania viacer\u00fdch HTTPS str\u00e1nok na jednej IP adrese sa pou\u017e\u00edvalo TLS roz\u0161\u00edrenie SNI, pri ktorom bolo meno po\u017eadovan\u00e9ho hostite\u013ea uveden\u00e9 v spr\u00e1ve ClientHello, ktor\u00e1 bola odoslan\u00e1 pred ustanoven\u00edm \u0161ifrovan\u00e9ho kan\u00e1la. T\u00e1to vlastnos\u0165 umo\u017enila na rann\u00fdch f\u00e1zach spracovania spojenia distribuova\u0165 po\u017eiadavky medzi virtu\u00e1lnymi hos\u0165ami, ale tie\u017e umo\u017enila internetov\u00e9mu poskytovate\u013eovi selekt\u00edvne filtrova\u0165 HTTPS prev\u00e1dzku a analyzova\u0165, ak\u00e9 str\u00e1nky pou\u017e\u00edvate\u013e nav\u0161tevuje, \u010do neumo\u017enilo dosiahnu\u0165 pln\u00fa d\u00f4vernos\u0165 pri pou\u017eit\u00ed HTTPS. <\/p>\n

Na rie\u0161enie tohto probl\u00e9mu a vyl\u00fa\u010denie \u00faniku \u00fadajov o po\u017eadovanej str\u00e1nke sa nesk\u00f4r navrhlo roz\u0161\u00edrenie ESNI, ktor\u00e9 realizuje \u0161ifrovanie \u00fadajov s n\u00e1zvom hostite\u013ea. Po\u010das zav\u00e1dzania ESNI sa zistilo, \u017ee navrhnut\u00fd mechanizmus neobsahuje v\u0161etky mo\u017en\u00e9 zdroje \u00faniku \u00fadajov o hostite\u013eovi a jeho aplik\u00e1cia nie je dostato\u010dn\u00e1 na zabezpe\u010denie \u00faplnej d\u00f4vernosti rel\u00e1ci\u00ed HTTPS. Konkr\u00e9tne pri obnoven\u00ed predt\u00fdm ustanovenej rel\u00e1cie sa n\u00e1zov dom\u00e9ny v otvorenej forme na\u010falej uv\u00e1dzal medzi parametrami TLS roz\u0161\u00edrenia PSK (Pre-Shared Key). Okrem toho pokusy o zavedenie ESNI odhalili probl\u00e9my s kompatibilitou a \u0161k\u00e1lovan\u00edm, ktor\u00e9 br\u00e1nili v\u0161eobecn\u00e9mu roz\u0161\u00edreniu ESNI. <\/p>\n

Vzh\u013eadom na zisten\u00e9 nedostatky ESNI bol vyvinut\u00fd nov\u00fd univerz\u00e1lny mechanizmus ECH, ktor\u00fd umo\u017e\u0148uje \u0161ifrovanie parametrov ak\u00fdchko\u013evek TLS roz\u0161\u00edren\u00ed. Technicky je hlavn\u00fd rozdiel medzi ECH a ESNI v tom, \u017ee namiesto samostatn\u00fdch pol\u00ed sa \u0161ifruje cel\u00e9 spr\u00e1va ClientHello. ECH predpoklad\u00e1 rozdelenie ClientHello na dve samostatn\u00e9 spr\u00e1vy \u2014 \u0161ifrovan\u00fa spr\u00e1vu ClientHelloInner (SNI Inner) a neza\u0161ifrovan\u00fa z\u00e1kladn\u00fa spr\u00e1vu ClientHelloOuter (SNI Outer). V neza\u0161ifrovanej SNI Outer sa pren\u00e1\u0161aj\u00fa d\u00f4vernos\u0165 neovplyv\u0148uj\u00face \u00fadaje, ako je verzia TLS a zoznam pou\u017eit\u00fdch \u0161ifrov, ako aj v\u0161eobecn\u00fd n\u00e1zov dom\u00e9ny, ktor\u00fd sa nepreh\u00fdba s aktu\u00e1lnym n\u00e1zvom po\u017eadovanej dom\u00e9ny. Napr\u00edklad pre v\u0161etk\u00fdch klientov Cloudflare sa vo neza\u0161ifrovanej SNI Outer uv\u00e1dza spolo\u010dn\u00fd hostite\u013e \u201ecloudflare-ech.com\u201c, zatia\u013e \u010do skuto\u010dn\u00fd n\u00e1zov po\u017eadovan\u00e9ho hostite\u013ea sa pren\u00e1\u0161a v \u0161ifrovanej SNI Inner a nie je dostupn\u00fd na anal\u00fdzu.

\"Vo<\/center> <\/p>\n

ECH tie\u017e pou\u017e\u00edva in\u00fa sch\u00e9mu distrib\u00facie k\u013e\u00fa\u010da na \u0161ifrovanie \u2014 inform\u00e1cie o verejnom k\u013e\u00fa\u010di sa pren\u00e1\u0161aj\u00fa v DNS z\u00e1znamoch HTTPSSVC, a nie v z\u00e1znamoch s typom TXT. Na z\u00edskanie a \u0161ifrovanie k\u013e\u00fa\u010da sa aplikova\u0165 autentifikovan\u00e9 end-to-end \u0161ifrovanie na z\u00e1klade mechanizmu HPKE (Hybrid Public Key Encryption). ECH tie\u017e podporuje bezpe\u010dn\u00fa op\u00e4tovn\u00fa distrib\u00faciu k\u013e\u00fa\u010da zo servera, \u010do m\u00f4\u017ee by\u0165 aplikovan\u00e9 v pr\u00edpade rot\u00e1cie k\u013e\u00fa\u010dov na serveri<\/a> a na vyrie\u0161enie probl\u00e9mov pri z\u00edskavan\u00ed zastaran\u00fdch k\u013e\u00fa\u010dov z cache DNS.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 Firefox \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 ECH (Encrypted Client Hello), \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 ESNI (Encrypted Server Name Indication) \u0438 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043b\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u0445 TLS-\u0441\u0435\u0430\u043d\u0441\u043e\u0432, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a \u0437\u0430\u043f\u0440\u043e\u0448\u0435\u043d\u043d\u043e\u0435 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0435 \u0438\u043c\u044f. \u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043a\u043e\u0434 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 ECH \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u0432 \u0432\u044b\u043f\u0443\u0441\u043a Firefox 85, \u043d\u043e \u0431\u044b\u043b \u043e\u0442\u043a\u043b\u044e\u0447\u0451\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0412 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":110432,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110431","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vo Firefox a Cloudflare je podporovan\u00e1 funkcia ECH na skrytie dom\u00e9ny v HTTPS prev\u00e1dzke | ProHoster","description":"Spolo\u010dnos\u0165 Mozilla ozn\u00e1mila implement\u00e1ciu podpory mechanizmu ECH (Encrypted Client Hello) pre pou\u017e\u00edvate\u013eov stabilnej vetvy Firefox, ktor\u00fd pokra\u010duje vo v\u00fdvoji technol\u00f3gie ESNI (Encrypted Server Name Indication) a.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Firefox \u0438 Cloudflare \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 ECH \u0434\u043b\u044f \u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0434\u043e\u043c\u0435\u043d\u0430 \u0432 HTTPS-\u0442\u0440\u0430\u0444\u0438\u043a\u0435 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 Firefox \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 ECH (Encrypted Client Hello), \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 ESNI (Encrypted Server Name Indication) \u0438.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-04T13:10:16+00:00","article:modified_time":"2023-10-04T13:10:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"110431","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:39:44","updated":"2026-02-09 21:46:41","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/110431","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=110431"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/110431\/revisions"}],"predecessor-version":[{"id":160302,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/110431\/revisions\/160302"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/110432"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=110431"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=110431"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=110431"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}