Encrypted Client Hello - 隐私的最后一个组成部分
2023-09-29
我们很高兴地宣布为改善互联网上每个人的隐私做出了贡献。Encrypted Client Hello 是一项新标准,可防止网络窥探用户访问的网站,现已在所有 Cloudflare 计划中可用...
继续阅读 »
\n \n
Encrypted Client Hello (ECH) 是 ESNI 的继任标准,它遮掩了用于协商 TLS 握手的服务器名称指示 (SNI)。这意味着只要用户访问 Cloudflare 上启用了 ECH 的网站,除了用户、Cloudflare 和网站所有者之外,任何人都无法确定访问的是哪个网站。Cloudflare 非常重视每个人的隐私,并对这项技术的应用前景感到兴奋。
\n每当您访问一个网站时,您的浏览器都会向 Web 服务器发送一个请求。Web 服务器以内容作为响应,网站开始在您的浏览器中加载。早在互联网诞生之初,这种情况是以“明文”形式出现的,也就是说,您的浏览器通过网络发送的内容,所有人都可以读取:您用于浏览的公司网络、为您提供互联网连接的互联网服务提供商,以及请求在到达托管网站的 Web 服务器之前所经过的任何网络。长期以来,隐私权倡导者一直担心“明文”会泄露多少信息:如果您和 Web 服务器之间的任何网络都能看到您的流量,这意味着他们也能看到您正在做的事情。如果您发起的是银行转账,任何中间方都可以看到转账的目的地和金额。
那么,如何使这些数据更加私密呢?为了防止窃听,人们引入了 SSL 和后来的 TLS 形式的加密技术。这些了不起的协议不仅能保护您的隐私,还能确保任何中间方都无法篡改您浏览或上传的任何内容。但是,加密技术也仅限于此。
虽然实际内容(您正在访问网站上的哪个特定页面以及您上传的任何信息)是加密的,不会被中间方发现,但仍有一些方法可以确定用户正在做什么。例如,通过 DNS 请求确定所访问网站的地址 (IP) 和 SNI 都是中间方跟踪使用情况的常用方法。
让我们从 DNS 开始。每当您访问一个网站时,您的操作系统都需要知道要连接到哪个 IP 地址。这是通过 DNS 请求实现的。默认情况下,DNS 是未加密的,这意味着任何人都能看到您所请求的网站。为了帮助用户遮盖这些请求,使中间方无法看到其内容,Cloudflare 在 2019 年推出了 DNS over HTTPS (DoH)。2020 年,我们更进一步,推出了 Oblivious DNS over HTTPS,即使 Cloudflare 也无法看到用户询问的网站。
这样,SNI 就成了最后一个未加密的位,中间方可以利用它来确定您访问的是哪个网站。执行 DNS 查询后,浏览器要做的第一件事就是执行 TLS 握手。握手包含几个步骤,包括使用哪种密码、哪种 TLS 版本以及哪种证书将用于验证 Web 服务器的身份。在握手过程中,浏览器将显示它打算访问的服务器(网站)名称:服务器名称指示。
由于会话尚未加密,并且服务器不知道要使用哪个证书,因此浏览器必须以明文形式传输此信息。以明文形式发送 SNI 意味着,任何中间方只需检查用于连接的第一个数据包,就能了解您正在访问哪个网站:
这意味着,尽管 TLS 和 DoH 做出了巨大努力,但您在互联网上访问的网站仍然不是真正的隐秘。今天,我们通过 ECH 为这一难题添上了最后一块缺失的拼图。有了 ECH,浏览器会与 Cloudflare 进行 TLS 握手,但不会使用特定于客户的主机名。这意味着,虽然中间方可以看到您正在访问 Cloudflare 上的_一个_网站,但他们永远无法确定您访问的是哪个网站。
\n要解释 ECH 如何运作,首先要了解 TLS 握手是如何进行的。TLS 握手会以 ClientHello 部分开始,它允许客户端说出要使用的密码、TLS 版本,以及(最重要的)它要访问的服务器 (SNI)。
使用 ECH 时,ClientHello 消息部分被分成两个独立的消息:内部部分和外部部分。外部部分包含非敏感信息,如要使用的密码和 TLS 版本。它还包括一个“外部 SNI”。内部部分已加密,包含“内部 SNI”。
外部 SNI 是一个普通名称,在我们的案例中,它表示用户正在尝试访问 Cloudflare 上的加密网站。我们选择 cloudflare-ech.com 作为所有网站在 Cloudflare 上共享的 SNI。由于 Cloudflare 控制着该域,因此我们拥有相应的证书,能够为该服务器名称协商 TLS 握手。
内部 SNI 包含用户试图访问的实际服务器名称。该信息使用公钥加密,只有 Cloudflare 才能读取。一旦握手完成,网页就会正常加载,就像通过 TLS 加载其他网站一样。
在实践中,这意味着任何试图确定您正在访问哪个网站的中间方都将只看到正常的 TLS 握手,但有一点需要注意:您在 Cloudflare 上访问启用了 ECH 的网站时,服务器名称看起来都是一样的。每次 TLS 握手看起来都是一样的,因为它看起来像是在试图加载 cloudflare-ech.com 的网站,而不是实际的网站。对于不希望中间方看到其所访问网站的用户,我们已经解决了保护用户隐私的最后一个难题。
\n有关 ECH 技术的全部细节,请访问我们的介绍性博客。
\n我们很期待看到这对互联网隐私的影响。Google Chrome 和 Firefox 等浏览器已经开始加强对 ECH 的支持。如果您经营一家网站,并且您希望用户在访问您的网站时不会被任何中间方看到用户在做什么,请立即在 Cloudflare 上启用 ECH。我们已经为所有免费区域启用了 ECH。如果您是现有的付费客户,只需前往 Cloudflare 仪表板申请该功能即可。我们将在未来几周内为所有报名客户启用此功能。
随着时间的推移,我们希望其他人也能跟随我们的脚步,为所有人打造一个更加私密的互联网。提供 ECH 的供应商越多,人们就越难监听用户在互联网上的行为。说不定,我们还能彻底解决隐私问题。
如果您想了解有关 ECH 的更多信息、其运作原理以及启用方法,请访问我们的 ECH 开发人员文档。
"],"published_at":[0,"2023-09-29T14:00:52.000+01:00"],"updated_at":[0,"2024-10-10T00:22:31.937Z"],"feature_image":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/3PuksTn93smbZyr2DhM0NO/d71cddf3921a4af2236c09349849301d/announcing-encrypted-client-hello.png"],"tags":[1,[[0,{"id":[0,"1Cv5JjXzKWKEA10JdYbXu1"],"name":[0,"Birthday Week"],"slug":[0,"birthday-week"]}],[0,{"id":[0,"6QktrXeEFcl4e2dZUTZVGl"],"name":[0,"产品新闻"],"slug":[0,"product-news"]}],[0,{"id":[0,"5yAI0xgfe9ztQ4dvWAgglk"],"name":[0,"Encrypted SNI"],"slug":[0,"encrypted-sni"]}],[0,{"id":[0,"1x7tpPmKIUCt19EDgM1Tsl"],"name":[0,"Research"],"slug":[0,"research"]}]]],"relatedTags":[0],"authors":[1,[[0,{"name":[0,"Achiel van der Mandele"],"slug":[0,"achiel"],"bio":[0,null],"profile_image":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/4PBX0l9SGxPiGW7UUCNph8/ef71a605cc41fd89c9ddf37e6a68a413/achiel.png"],"location":[0,null],"website":[0,null],"twitter":[0,null],"facebook":[0,null]}],[0,{"name":[0,"Alessandro Ghedini"],"slug":[0,"alessandro-ghedini"],"bio":[0,null],"profile_image":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/6ysyaWM0uyFhi5F9X2t0jw/14d2e374a965b36818ee73b00412f671/alessandro-ghedini.jpg"],"location":[0,null],"website":[0,null],"twitter":[0,null],"facebook":[0,null]}],[0,{"name":[0,"Christopher Wood"],"slug":[0,"christopher"],"bio":[0,null],"profile_image":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/EAlXDk7jyC8y5YJUgvUmR/ff577ba53cb138b58a7387aa75f2b458/christopher.png"],"location":[0,null],"website":[0,null],"twitter":[0,null],"facebook":[0,null]}],[0,{"name":[0,"Rushil Mehra"],"slug":[0,"rushil-mehra"],"bio":[0,null],"profile_image":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/4C0hIM94DE2YvmWRQcHfN1/943b024a7a20b37af08f873891f7f142/rushil-mehra.jpeg"],"location":[0,null],"website":[0,null],"twitter":[0,null],"facebook":[0,null]}]]],"meta_description":[0,null],"primary_author":[0,{}],"localeList":[0,{"name":[0,"Encrypted Client Hello - the last puzzle piece to privacy Config"],"enUS":[0,"English for Locale"],"zhCN":[0,"Translated for Locale"],"zhHansCN":[0,"No Page for Locale"],"zhTW":[0,"Translated for Locale"],"frFR":[0,"No Page for Locale"],"deDE":[0,"No Page for Locale"],"itIT":[0,"No Page for Locale"],"jaJP":[0,"Translated for Locale"],"koKR":[0,"Translated for Locale"],"ptBR":[0,"No Page for Locale"],"esLA":[0,"No Page for Locale"],"esES":[0,"No Page for Locale"],"enAU":[0,"No Page for Locale"],"enCA":[0,"No Page for Locale"],"enIN":[0,"No Page for Locale"],"enGB":[0,"No Page for Locale"],"idID":[0,"No Page for Locale"],"ruRU":[0,"No Page for Locale"],"svSE":[0,"No Page for Locale"],"viVN":[0,"No Page for Locale"],"plPL":[0,"No Page for Locale"],"arAR":[0,"No Page for Locale"],"nlNL":[0,"No Page for Locale"],"thTH":[0,"No Page for Locale"],"trTR":[0,"No Page for Locale"],"heIL":[0,"No Page for Locale"],"lvLV":[0,"No Page for Locale"],"etEE":[0,"No Page for Locale"],"ltLT":[0,"No Page for Locale"]}],"url":[0,"https://blog.cloudflare.com/announcing-encrypted-client-hello"],"metadata":[0,{"title":[0,"Encrypted Client Hello - 隐私的最后一个组成部分"],"description":[0,null],"imgPreview":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/17xLQu9Fowz7vbMIogeZg2/a5eb5b920f5a221acd12cebd453c301a/announcing-encrypted-client-hello-jRLDe7.png"]}]}],"locale":[0,"zh-cn"],"translations":[0,{"posts.by":[0,"作者"],"footer.gdpr":[0,"GDPR"],"lang_blurb1":[0,"这篇博文也有 {lang1} 版本。"],"lang_blurb2":[0,"这篇博文也有 {lang1} 和{lang2}版本。"],"lang_blurb3":[0,"这篇博文也有 {lang1}、{lang2} 和{lang3}版本。"],"footer.press":[0,"新闻"],"header.title":[0,"Cloudflare 博客"],"search.clear":[0,"清除"],"search.filter":[0,"过滤"],"search.source":[0,"来源"],"footer.careers":[0,"招聘"],"footer.company":[0,"公司"],"footer.support":[0,"支持"],"footer.the_net":[0,"theNet"],"search.filters":[0,"过滤器"],"footer.our_team":[0,"我们的团队"],"footer.webinars":[0,"网络研讨会"],"page.more_posts":[0,"更多帖子"],"posts.time_read":[0,"{time} 分钟阅读时间"],"search.language":[0,"语言"],"footer.community":[0,"社区"],"footer.resources":[0,"资源"],"footer.solutions":[0,"解决方案"],"footer.trademark":[0,"商标"],"header.subscribe":[0,"订阅"],"footer.compliance":[0,"合规性"],"footer.free_plans":[0,"Free 计划"],"footer.impact_ESG":[0,"影响/ESG"],"posts.follow_on_X":[0,"在 X 上关注"],"footer.help_center":[0,"帮助中心"],"footer.network_map":[0,"网络地图"],"header.please_wait":[0,"请稍候"],"page.related_posts":[0,"相关帖子"],"search.result_stat":[0,"针对 {search_keyword} 的第 {search_range} 个搜索结果(共 {search_total} 个结果)"],"footer.case_studies":[0,"案例研究"],"footer.connect_2024":[0,"Connect 2024"],"footer.terms_of_use":[0,"服务条款"],"footer.white_papers":[0,"白皮书"],"footer.cloudflare_tv":[0,"Cloudflare TV"],"footer.community_hub":[0,"社区中心"],"footer.compare_plans":[0,"比较各项计划"],"footer.contact_sales":[0,"联系销售"],"header.contact_sales":[0,"联系销售团队"],"header.email_address":[0,"电子邮件地址"],"page.error.not_found":[0,"未找到页面"],"footer.developer_docs":[0,"开发人员文档"],"footer.privacy_policy":[0,"隐私政策"],"footer.request_a_demo":[0,"请求演示"],"page.continue_reading":[0,"继续阅读"],"footer.analysts_report":[0,"分析报告"],"footer.for_enterprises":[0,"企业级服务"],"footer.getting_started":[0,"开始使用"],"footer.learning_center":[0,"学习中心"],"footer.project_galileo":[0,"Project Galileo"],"pagination.newer_posts":[0,"较新的帖子"],"pagination.older_posts":[0,"较旧的帖子"],"posts.social_buttons.x":[0,"在 X 上讨论"],"search.icon_aria_label":[0,"搜索"],"search.source_location":[0,"来源/位置"],"footer.about_cloudflare":[0,"关于 Cloudflare"],"footer.athenian_project":[0,"Athenian Project"],"footer.become_a_partner":[0,"成为合作伙伴"],"footer.cloudflare_radar":[0,"Cloudflare Radar"],"footer.network_services":[0,"网络服务"],"footer.trust_and_safety":[0,"信任与安全"],"header.get_started_free":[0,"免费开始使用"],"page.search.placeholder":[0,"搜索 Cloudflare"],"footer.cloudflare_status":[0,"Cloudflare 状态"],"footer.cookie_preference":[0,"Cookie 首选项"],"header.valid_email_error":[0,"必须是有效的电子邮件地址。"],"search.result_stat_empty":[0,"显示第 {search_range} 个结果(共 {search_total} 个结果)"],"footer.connectivity_cloud":[0,"全球连通云"],"footer.developer_services":[0,"开发人员服务"],"footer.investor_relations":[0,"投资者关系"],"page.not_found.error_code":[0,"错误代码:404"],"search.autocomplete_title":[0,"请输入查询内容。按回车键发送"],"footer.logos_and_press_kit":[0,"标识与媒体资料包"],"footer.application_services":[0,"应用程序服务"],"footer.get_a_recommendation":[0,"获得推荐"],"posts.social_buttons.reddit":[0,"在 Reddit 上讨论"],"footer.sse_and_sase_services":[0,"SSE 和 SASE 服务"],"page.not_found.outdated_link":[0,"您可能使用了过期的链接,或者输入了错误的地址。"],"footer.report_security_issues":[0,"报告安全问题"],"page.error.error_message_page":[0,"抱歉,我们找不到您要打开的页面。"],"header.subscribe_notifications":[0,"订阅以接收新文章的通知:"],"footer.cloudflare_for_campaigns":[0,"Cloudflare for Campaigns"],"header.subscription_confimation":[0,"订阅已确认。感谢订阅!"],"posts.social_buttons.hackernews":[0,"在 Hacker News 上讨论"],"footer.diversity_equity_inclusion":[0,"多元、公平与包容"],"footer.critical_infrastructure_defense_project":[0,"关键基础设施防护项目"]}]}" ssr="" client="load" opts="{"name":"PostCard","value":true}" await-children="">2023-09-29
我们很高兴地宣布为改善互联网上每个人的隐私做出了贡献。Encrypted Client Hello 是一项新标准,可防止网络窥探用户访问的网站,现已在所有 Cloudflare 计划中可用...
继续阅读 »