Hacker News Reader

Comment by szmarczak | Hacker News Reader

It doesn't prevent fingerprinting, stop spreading misinformation. It only prevents your ISP from knowing what website you're connecting to.

View on HN

Since most ISPs also maintain their own DNS resolver, they could always reverse lookup the IP address AFAIK.

True. ECH is useless if you're using plain DNS. DNS over TLS or HTTPS is the way to go.

The whole idea behind ECH is one IP hosts tons of sites (eg. CDN) so you have no idea which one it is.

Also reverse lookup has nothing to do with hosting own DNS resolver.

What you're describing is a SNI, not ECH. Those two serve very different purposes.

> Also reverse lookup has nothing to do with hosting own DNS resolver.

It has everything to do with that. Had you used two brain cells, you would've known that they can memorize the IP address and the domain name, and if you connect to that IP in a short period of time, most likely you visited that domain name.

SNI is unencrypted, so your ISP can see it. ECH encrypts it.

How does this relate to my comment?

What OP wrote seems correct:

> ECH basically kills TLS fingerprinting as a bot detection signal

They are not talking about fingerprinting in general. Please elaborate how else TLS fingerprinting can be done.

I am talking about TLS fingerprinting, not JS fingerprinting.

> Please elaborate how else TLS fingerprinting can be done.

By doing everything as it is right now?

How would you (an arbitrary web server) fingerprint a TLS connection if the Client Hello is encrypted?

The website owner (or cloudflare in this case) has the keys to decrypt the client hello. That's necessary for routing information.

You're right, sorry! I got confused myself.

By decrypting it? I don't think you know how TLS, or E2E works in general. ISP doesn't perform the fingerprinting, the server does.

Of course! My bad, thanks for engaging.

Reply on news.ycombinator.com