RFC 9849. TLS Encrypted Client Hello

Re:RFC 9849. TLS Encrypted Client Hello by hzwanip on Wednesday March 04, 2026 @05:48AM (#47245712)

What OP wrote seems correct:

> ECH basically kills TLS fingerprinting as a bot detection signal

They are not talking about fingerprinting in general. Please elaborate how else TLS fingerprinting can be done.

[ Parent | on HN ]

Re:RFC 9849. TLS Encrypted Client Hello by szmarczak on Wednesday March 04, 2026 @05:56AM (#47245773)

I am talking about TLS fingerprinting, not JS fingerprinting.

> Please elaborate how else TLS fingerprinting can be done.

By doing everything as it is right now?

[ Parent | on HN ]

Re:RFC 9849. TLS Encrypted Client Hello by hzwanip on Wednesday March 04, 2026 @05:59AM (#47245805)

How would you (an arbitrary web server) fingerprint a TLS connection if the Client Hello is encrypted?

[ Parent | on HN ]

Re:RFC 9849. TLS Encrypted Client Hello by szmarczak on Wednesday March 04, 2026 @06:10AM (#47245893)

By decrypting it? I don't think you know how TLS, or E2E works in general. ISP doesn't perform the fingerprinting, the server does.

[ Parent | on HN ]

Re:RFC 9849. TLS Encrypted Client Hello by hzwanip on Wednesday March 04, 2026 @06:15AM (#47245920)

Of course! My bad, thanks for engaging.

[ Parent | on HN ]

Re:RFC 9849. TLS Encrypted Client Hello by conradludgate on Wednesday March 04, 2026 @06:07AM (#47245873)

The website owner (or cloudflare in this case) has the keys to decrypt the client hello. That's necessary for routing information.

[ Parent | on HN ]

Re:RFC 9849. TLS Encrypted Client Hello by hzwanip on Wednesday March 04, 2026 @06:09AM (#47245884)

You're right, sorry! I got confused myself.

[ Parent | on HN ]