/cdn-cgi/trace on any website also shows `sni` sni=plaintext vs sni=encrypted

/cdn-cgi/trace on any website also shows

sni

sni

sni=plaintext
vs
sni=encrypted

CChaika /cdn-cgi/trace on any website also shows `sni` sni=plaintext vs sni=encrypted

D5•3/15/25, 5:42 PM

But it's not ECH, right?

DD5 But it's not ECH, right?

ChaikaOP•3/15/25, 5:43 PM

ESNI is gone (Cloudflare switched to ECH, same w/ FF, etc)

D5•3/15/25, 5:43 PM

Okay, then (at least) free plans websites are not using ECH

ChaikaOP•3/15/25, 5:44 PM

yea it's been a weird rollout, at least a few pushes and then reverts

ChaikaOP•3/15/25, 5:44 PM

think there was some upstream issues they wanted to get resolved at one point, not sure if that's what's stopping it now

WWalshy https://dns.google/query?name=free.walshy.dev&rr_type=HTTPS&ecs=

Walshy•3/15/25, 5:45 PM

i'm ech enabled /shrug

D5•3/15/25, 5:45 PM

So the excuse from LaLiga to apply massive blocking seems to be invalid if that's confirmed

Walshy•3/15/25, 5:45 PM

but my account is also beyond special haha

WWalshy i'm ech enabled /shrug

ChaikaOP•3/15/25, 5:45 PM

not even crypto.cloudflare.com has it enabled anymore

ChaikaOP•3/15/25, 5:47 PM

hmm I have a few free zones with it enabled but not all

ChaikaOP•3/15/25, 5:48 PM

if you have pro or higher it's an option under ssl/tls -> edge certs, seems to be fully respected but off by default

.•3/15/25, 6:53 PM

hola

DD5 So the excuse from LaLiga to apply massive blocking seems to be invalid if that'...

az•3/16/25, 12:19 AM

do you have a link?

Aaz do you have a link?

D5•3/16/25, 12:25 AM

A link of what?

az•3/16/25, 12:27 AM

oh sorry i thought u were sharing an update on the laliga situation

az•3/16/25, 12:27 AM

im pretty sure most websites do have ech, all of mine do and theyre on the free plan

Aaz oh sorry i thought u were sharing an update on the laliga situation

D5•3/16/25, 12:31 AM

No updates unfortunately. From what I understood, the latest thing used to block entire IPs was due to Cloudflare using ECH.
So looks like it doesn't make sense since it's not being used

DD5 No updates unfortunately. From what I understood, the latest thing used to block...

az•3/16/25, 12:32 AM

the site from your bio is using it

Aaz the site from your bio is using it

D5•3/16/25, 12:34 AM

Quic ≠ ECH

az•3/16/25, 12:34 AM

the last column is the SNI

D5•3/16/25, 12:34 AM

Oh, I see, it's the second IP address

D5•3/16/25, 12:34 AM

Interesting

Aaz the site from your bio is using it

D5•3/16/25, 12:35 AM

How did you get that?

DD5 How did you get that?

az•3/16/25, 12:35 AM

wireshark

az•3/16/25, 12:36 AM

added the SNI from the outer client hello as a column in wireshark

D5•3/16/25, 12:36 AM

Okay, interesting

D5•3/16/25, 12:37 AM

Looks like
https://dh-sw.net is actually using it.
My subdomains like
https://inicio.dh-sw.net (redirect from main domain)
https://service.dh-sw.net/v1

And others are not using it

DD5 Looks like https://dh-sw.net is actually using it. My subdomains like https://...

ChaikaOP•3/16/25, 12:38 AM

eh I think the https lookup is just lazy

D5•3/16/25, 12:38 AM

But they're affected anyways

DD5 Looks like https://dh-sw.net is actually using it. My subdomains like https://...

az•3/16/25, 12:38 AM

ignore nvidia in the middle but both of the subdomains have it enabled for me too

ChaikaOP•3/16/25, 12:38 AM

I don't think the browser blocks for the https record lookup (and its reset if you hard refresh), or something along those lines, it's def supported on the subdomains

CChaika eh I think the https lookup is just lazy

D5•3/16/25, 12:38 AM

wdym?

DD5 wdym?

ChaikaOP•3/16/25, 12:39 AM

it has to lookup the https record to see ech support/etc

Aaz ignore nvidia in the middle but both of the subdomains have it enabled for me to...

D5•3/16/25, 12:39 AM

Weird. No idea why in some cases it's enabled and others not

CChaika it has to lookup the https record to see ech support/etc

D5•3/16/25, 12:40 AM

I did. Still showing without ECH

ChaikaOP•3/16/25, 12:40 AM

chaik@ash:~$ dig inicio.dh-sw.net https +short
1 . alpn="h3,h2" ipv4hint=104.21.16.1,104.21.32.1,104.21.48.1,104.21.64.1,104.21.80.1,104.21.96.1,104.21.112.1 ech=AEX+DQBBOwAgACBbqnLeAhRhhU0+EDxnIOla6O7FndMj8smocxf663njTwAEAAEAAQASY2xvdWRmbGFyZS1lY2guY29tAAA= ipv6hint=2606:4700:3030::6815:1001,2606:4700:3030::6815:2001,2606:4700:3030::6815:3001,2606:4700:3030::6815:4001,2606:4700:3030::6815:5001,2606:4700:3030::6815:6001,2606:4700:3030::6815:7001

ChaikaOP•3/16/25, 12:41 AM

I meant more in the implementation of Firefox though (or whatever browser you're using)

ChaikaOP•3/16/25, 12:41 AM

sometimes I hard refresh/visit for the first time and it isn't ech until reload

Erisa•3/16/25, 12:41 AM

seems counter-intuitive to the purpose of ech lol

ChaikaOP•3/16/25, 12:41 AM

FF docs say

Firefox retrieves this data simultaneously with performing a DNS lookup when connecting to a website, ensuring there's no extra delay during the connection.

wonder what happens if the https record lookup takes longer then the A/AAAA, if it just doesn't use it or something, they specifically say "no extra delay"

D5•3/16/25, 12:43 AM

Okay, then I don't understand why some ISPs are able to find what's the hostname or the website you're visiting and other not

az•3/16/25, 12:44 AM

tls 1.3 is a requirement of ech right?

ChaikaOP•3/16/25, 12:44 AM

looks like there's a firefox config setting to make it wait for the https record lookup

network.dns.force_waiting_https_rr Whether to wait for the HTTPS RR lookup to complete before starting a connection. Boolean True True

https://wiki.mozilla.org/Security/Encrypted_Client_Hello
It kinda looks like it's on by default though, so maybe my theory is wrong, will try forcing it...

ChaikaOP•3/16/25, 12:50 AM

ech's always been a little weird. Used to need DoH for a while, only later was relaxed

ChaikaOP•3/16/25, 12:50 AM

looks like for me turning on DoH made it much more consistent, still seems to revert on hard refresh weirdly but meh

Original message was deleted

ChaikaOP•3/16/25, 12:52 AM

part of the reason why DoH is pushed with it

Original message was deleted

ChaikaOP•3/16/25, 12:52 AM

I believe a bunch of CDNs stop that now, I forget if CF does

ChaikaOP•3/16/25, 12:57 AM

Azure's Front door adverts not supporting "Domain Fronting" like it's a feature lol