Re:RFC 9849. TLS Encrypted Client Hello
by szmarczak on Wednesday March 04, 2026 @06:54AM
(#47246192)
> the part that changes is passive fingerprinting from third parties
That's exactly what I said:
> It only prevents your ISP from knowing what website you're connecting to.
Why would Clownflare ever see traffic to sites not on Clownflare?
Re:RFC 9849. TLS Encrypted Client Hello
by szmarczak on Wednesday March 04, 2026 @06:56AM
(#47246216)
They do routing. Even if you're connecting to a non Cloudflare server, the traffic may still be routed through their servers.
Why would they want to peek traffic? Most likely for statistics (most frequently visited websites etc).
Can you give an example of a BGP route or traceroute to a site not on Clownflare that was routed through Clownflare?
Re:RFC 9849. TLS Encrypted Client Hello
by szmarczak on Wednesday March 04, 2026 @08:33AM
(#47247168)
It depends on the origin and the destination. Their Magic Transit service explicitly allow this, and I assume they have agreements with other AS in case something goes wrong on either side (it often does). You'd have to directly ask them to know specifically but I don't think they would answer since that's proprietary information.
Re:RFC 9849. TLS Encrypted Client Hello
by Hizonner on Wednesday March 04, 2026 @05:31PM
(#47254901)
> the part that changes is passive fingerprinting from third parties - network middleboxes, ISPs, DPI systems
Right. Things that should never have been allowed to exist to begin with. Working as designed.
the part that changes is passive fingerprinting from third parties - network middleboxes, ISPs, DPI systems that have historically been able to read ClientHello parameters in transit and build behavioral profiles. that layer goes away. for bot detection specifically that matters less since detection happens at the server, so your correction stands for that use case.
the Cloudflare paradox I was gesturing at is maybe better framed as: for sites NOT on Cloudflare, ECH makes it harder for Cloudflare (as a network observer) to do pre-connection fingerprinting. but for their own CDN customers, they decrypt it anyway so nothing changes for them. the conflict is more theoretical than practical for their current product.