mirrors/dnscrypt-proxy
1
0
Fork 0
mirror of https://github.com/DNSCrypt/dnscrypt-proxy.git synced 2025-03-04 02:14:40 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

ECHO is now ECH

Frank Denis 2020-05-21 22:22:05 +02:00
parent 7e6a413411
commit 9045778499
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
Local-DoH.md

@ -1,4 +1,4 @@
# Built-in DoH server / Firefox ESNI (ECHO)
# Built-in DoH server / Firefox ESNI (Encrypted ClientHello)
In addition to responding to standard DNS queries, `dnscrypt-proxy` can also act as a DoH server, and respond to local queries sent over that protocol.
@ -40,7 +40,7 @@ cert_key_file = "privkey.pem"
## How to enable ESNI in Firefox
Firefox and Cloudflare are currently running an experiment called ESNI. ESNI is the old name of ECHO, a TLS extension to hide the server name in TLS (including HTTPS) connections.
Firefox and Cloudflare are running an experiment called ESNI. ESNI is the name of an obsolete version of ECH (Encrypted ClientHello), a TLS extension to hide the server name in TLS (including HTTPS) connections.
While this may eventually be a significant privacy improvement, it current has some caveats to be aware of:
@ -49,7 +49,7 @@ While this may eventually be a significant privacy improvement, it current has s
- What has been deployed is still missing an important part to protect against censorship (`GREASE`)
- Enabling ESNI will trigger an extra DNS query for every single new hostname, even for hosts that don't support ESNI. Every time a query for a host that doesn't support is made, an error will be returned (`NXDOMAIN`).
- Enabling ESNI in Firefox breaks some websites ("Secure connection failed - `SSL_ERROR_NO_CYPHER_OVERLAP`" or "[SSL_ERROR_MISSING_ESNI_EXTENSION](https://www.google.com/search?q=%22SSL_ERROR_MISSING_ESNI_EXTENSION%22)").
- Keep in mind that ECHO doesn't exist yet. What is available is only an experiment run by two companies.
- Keep in mind that ECH doesn't exist yet. What is available is only an experiment run by two companies.
Firefox has a setting to enable ESNI, but for some reason, the web browser ignores it unless it was also configured to bypass your DNS settings.