Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
norden.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
Moin! Dies ist die Mastodon-Instanz für Nordlichter, Schnacker und alles dazwischen. Folge dem Leuchtturm.

Administered by:

Server stats:

3.5K
active users

norden.social: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.7

#ech

1 post1 participant0 posts today
Public
Stéphane Bortzmeyer

#IETF

Argh, le futur RFC sur l'exportation des clés #TLS (SSLKEYLOGFILE), qui avait été approuvé, a été retiré de la file d'attente des RFC. Vu le retard pris, il fallait lui ajouter les derniers trucs (notamment #ECH).

Bref, ce n'est pas encore normalisé. (Alors que c'est crucial pour le déboguage, cf. mon talk à Capitole du Libre cfp.capitoledulibre.org/cdl-20 )

cfp.capitoledulibre.orgDéboguer les applications réseau lorsque tout est chiffré Capitole du Libre 2022Aujourd'hui, toute application réseau sérieuse utilise un chiffrement de bout en bout. Le but est notamment d'éviter que des tiers indiscrets n'écoutent la communication. Mais cela empêche également les tiers gentils d'écouter, ce qui complique le déboguage. C'est pourtant si pratique d'utiliser Wireshark pour déboguer. Alors, comment faire ?
Public *
Mynacol

I just noticed that my #Firefox was sending network traffic either with HTTP/2 + #ECH + #X25519MLKEM768, or with HTTP/3, but without ECH or X25519MLKEM768. Then I dug into about:config and found the option network.http.http3.enable_kyber, enabling it fixed the above behavior. HTTP/3 + ECH + X25519MLKEM768 is now used. Maybe check your Firefox behavior to ensure ECH and post-quantum key exchange is used whenever possible. Test site: https://cloudflare-ech.com/cdn-cgi/trace

Public
Jan Schaumann

Looks like Russia is now blocking Cloudflare's Encrypted Client Hello traffic if:
- SNI is cloudflare-ech.com
- TLS ClientHelloOuter contains the "encrypted_client_hello" extension

github.com/net4people/bbs/issu

Russia officially recommends "owners of information resources disable the TLS ECH extension or, more correctly, use domestic CDN services".

cmu.gov.ru/ru/news/2024/11/07/

With increased ECH use, I expect certain other actors to follow suit.

GitHubBlocking of Cloudflare ECH in Russia, 2024-11-05 · Issue #417 · net4people/bbsBy wkrp
#tls#ech
Public
Mynacol
Cloudflare finally re-enabled #ECH Encrypted ClientHello to protect user privacy a bit more. All free accounts have it enabled without choice, all other account types have to manually enable it.
As one might have guessed, Cloudflare reverted their rollout last year because issues in some corner cases and maybe also TLS-intercepting proxies were found. But at last it was re-enabled.

(Zstd support and HTTP/3 improvements are also good and nice)

https://blog.cloudflare.com/new-standards/
The Cloudflare Blog · New standards for a faster and more private InternetCloudflare's customers can now take advantage of Zstandard (zstd) compression, offering 42% faster compression than Brotli and 11.3% more efficiency than GZIP. We're further optimizing performance for our customers with HTTP/3 prioritization and BBR congestion control, and enhancing privacy through Encrypted Client Hello (ECH).
Public
Hans-Christoph Steiner

Given my work on #privacy, #censorship circumvention, #ech, etc. this #Brazil #Musk case is giving me pause. I have lots of questions, but no clear answers yet. Are there parallels to the DoH case here? Is making the internet more private contributing to centralization of power? e.g. billionaires like Musk can broadcast over the whole internet whatever they want, and governments have no power to stop it. The 99% do have to follow our govs.

#EncryptedClientHello#internet
Public
Digitale Gesellschaft (CH)

Kein Schweizerischer Alleingang

beim neuen #eCH-Standard zu «#Transparenz, Erklärbarkeit und #Risiken der #KI-Systeme»!

#Stellungnahme für eine transparente und faire Nutzung von KI sowie auf ein stringentes Management technischer und gesellschaftlicher Risiken von KI-Systemen: digitale-gesellschaft.ch/2024/

Continued thread
Public
Mynacol

Now I just have to wait for #nginx and #openssl to support #HTTP3 and #ECH to deploy it here. I won’t switch to an openssl fork due to security concerns and instead wait. The nginx HTTP/3 support is experimental and seems to become good fast and openssl plans to publish version 3.4 with initial QUIC server side support until end of October (although nginx has a compatibility mode for openssl, supporting HTTP/3 with previous openssl versions already). NixOS provides a special nginxQuic packet that enables the experimental nginx-side support but also uses quictls instead of openssl, which is understandable, but I don’t wanna use it. Additionally, the last nginx version fixed some HTTP/3 security issues so it’s better to wait some more.

nginx.orgnginx
Replied in thread
Public
Mynacol
@bagder
Regarding native HTTPS DNS records for #ECH: Firefox recently added support for those in their code. Maybe that code helps you implement support in curl. In short: on Unix it uses `res_nquery` (glibc) or `res_query` (musl, macos), on Windows `DnsQuery_A` and on Android `android_res_nquery` (available since Android 10).
The relevant code can be found here: https://searchfox.org/mozilla-central/search?q=ResolveHTTPSRecord&path=&case=false®exp=false
searchfox.orgSearch - mozsearch
ExploreLive feeds
About