Encrypted Client Hello
I see a lot of confusion here, probably Cloudflare should have included an explanation of how ECH works in TFA instead of referring to their other article[1].<p>The difference between ECH and SNI is that while SNI includes the hostname in the ClientHello (the first TLS record indicating connection initiation), ECH includes an encrypted section in the ClientHello called ClientHelloInner, and the hostname is moved inside it.<p>The ClientHelloInner is encrypted using a public key made available over DNS, which is queried over DNS over HTTPS providers such as Google or Cloudflare DNS; plaintext DNS is avoided in order to prevent a MITM on the ClientHelloInner key.<p>Doing so prevents ISPs and governments from analyzing your traffic. However, a CDN operator such as Cloudflare terminates TLS for your website, and thus traffic would be visible to them either way.<p>Now, to the non-technical part of it: while ECH provides a significant privacy improvement, I personally am against its implementation. Most ISPs enforce country-specific orders to block domains using a combination of DNS packet interception and SNI inspection. The legitimacy or sanity of such laws are a separate matter - countries would want to block websites that violate their laws.<p>If we take away this last resort from governments, they would react by enforcing client side blocklisting and DRMization as suggested in France[2], or force root certificate installation using legislation[3], or blocking large swathes of the internet as is the case with China.<p>[1] <a href="https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;encrypted-client-hello&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;encrypted-client-hello&#x2F;</a><p>[2] <a href="https:&#x2F;&#x2F;www.article19.org&#x2F;resources&#x2F;france-proposed-internet-bill-threatens-online-speech&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.article19.org&#x2F;resources&#x2F;france-proposed-internet...</a><p>[3] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Kazakhstan_man-in-the-middle_attack" rel="nofollow noreferrer">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Kazakhstan_man-in-the-middle_a...</a>