As web users, what we say and do online is subject to pervasive surveillance. Although we typically associate online tracking with ad networks and other th
Yes I had missed the part of the article where they described their opt-out behavior.
There is no technical reason for them to do it that way and it is a poor way of automatically determining an opt-out for the sake of not pissing off enterprise users (who rely on SNI for filtering). It is needlessly hostile to tie this privacy future to a different one instead of just using a separate toggle and corporate policy setting. ECH isn’t DNS and shouldn’t be tied to the DNS server setting.
For a local annoying example, NextDNS automatically blocks DoH via the canary domain use-application-dns.net. If I set my router up to use NextDNS over DoH, Firefox automatically disables DoH and ECH internally. I want it to use my router’s DNS, because everything is centrally logged, automatically organized by hostname, and it does local caching. I’d still rather my ISP can’t view SNI information. If I want ECH I have to manually enable DoH on every machine, and do more hoops if I want central logging to work correctly.
Regarding no technical reason, you can return these public keys from any normal DNS:
Yes I had missed the part of the article where they described their opt-out behavior.
There is no technical reason for them to do it that way and it is a poor way of automatically determining an opt-out for the sake of not pissing off enterprise users (who rely on SNI for filtering). It is needlessly hostile to tie this privacy future to a different one instead of just using a separate toggle and corporate policy setting. ECH isn’t DNS and shouldn’t be tied to the DNS server setting.
For a local annoying example, NextDNS automatically blocks DoH via the canary domain use-application-dns.net. If I set my router up to use NextDNS over DoH, Firefox automatically disables DoH and ECH internally. I want it to use my router’s DNS, because everything is centrally logged, automatically organized by hostname, and it does local caching. I’d still rather my ISP can’t view SNI information. If I want ECH I have to manually enable DoH on every machine, and do more hoops if I want central logging to work correctly.
Regarding no technical reason, you can return these public keys from any normal DNS:
$ dig +short crypto.cloudflare.com TYPE65 1 . alpn="http/1.1,h2" ipv4hint=162.159.137.85,162.159.138.85 ech=AEX+DQBBvgAgACCLKBP960E1dfY35YFbosHcVzvpz1E4fsqxzwGhtPpZagAEAAEAAQASY2xvdWRmbGFyZS1lY2guY29tAAA= ipv6hint=2606:4700:7::a29f:8955,2606:4700:7::a29f:8a55