ECH is the acronym for Encrypted Client Hello. We can say that it is a part, an extension, of the TLS protocol. It is used by web pages encrypted by HTTPS. What it allows is to browse more privately and even prevent the operator from using the filtering system. Google Chrome, with its latest update, already includes this protocol.
ECH allows private browsing
From cloudflare, they have announced the activation of ECH throughout their network. This, together with the fact that Chrome already allows the use of this protocol, will make browsing the Internet more private and secure. Until now, TLS had the SNI field unencrypted. What does this mean? Operators, for example, could use filters to avoid accessing certain pages.
To protect the SNI, Cloudflare launched eSNI in 2019. This did not last too long, as two years later it was withdrawn and replaced by ECH. During this time, operators have had an easier time blocking connections. For example, they have been able to block sites that broadcast pirated content, such as a sporting event.
For now, although ECH continues to be in constant transformation, Cloudflare’s announcement that it is going to activate it throughout its network is significant. This is combined with the fact that Google Chrome already supports it. All this means that, a page hosted on Cloudflarewhether in the free or paid version, will avoid being blocked.
Until now, one option was to use a VPN. But of course, this can cause problems, not everyone knows how to configure it correctly and, ultimately, errors were more likely. Now, thanks to ECH, navigation will be really private and secure. What ECH does is to completely encrypt the ClientHello message, under the public key of the client-server.
How operators see the SNI
What options do operators have to be able to see the SNI of a connection and be able to block it? They achieve this thanks to the DPI systems of the operators. Basically, there is a list of web domains that broadcast pirated content and can block it. The operators are going to resort to package inspection and thus obtain the SNI.
When the operator detects this irregularity, it prevents access to that website. However, they can also opt for DNS blocking, although it is less used. There are hundreds of pages blocked in Spain through this system and when someone tries to access them, they receive an error message.
LaLiga and La Coalión now see ECH as a risk. Users will be able to browse with greater privacy and security, so they will not be able to obtain the SNI easily, as has happened until now. This will make it impossible for those websites, hosted behind Cloudflare, to be blocked.
