logoalt Hacker News

conradludgatetoday at 11:13 AM1 replyview on HN

ECH doesn't benefit you if you're connecting directly to one IP. Middleboxes can track that you're connecting to this IP.

ECH prevents tracking through routing layers where your ClientHello might contain foo.example.com or bar.example.com but route via the same IP (Cloudflare). A middlebox can see you are using a cloudflare hosted website, but not know what cloudflare website.

There's no benefit encrypting the SNI with 10.20.30.40 if they can see you're connecting to 10 20.30.40 anyway


Replies

jeroenhdtoday at 12:28 PM

THe benefit is that the SNI is not being logged. Resolving an IP to a domain name is pretty hard for a small actor who doesn't have a record of all DNS records.

show 1 reply