• LedgeDrop@lemmy.zip
    link
    fedilink
    English
    arrow-up
    2
    arrow-down
    1
    ·
    16 hours ago

    You’re absolutely right: adblockers (even via pi-hole) will be ineffective.

    Not mentioned in this article, but ECH lays the foundation for each application to decide if they trust the upstream DNS provider or not.

    Normally, an app trusts all pre-installed CAs. If any of these CAs were to issue a fraudulent certificate, the app would be at risk from an on-path attacker. Some apps choose to limit the set of certificates they accept by either limiting the set of CAs they trust or by certificate pinning.

    Source

    So using custom DNS to block/prevent unwanted updates and to block ads will be a thing of the past.

    …but this does mean if your ISP or country is censoring the internet: their job has gotten much more difficult.

    • cron@feddit.org
      link
      fedilink
      English
      arrow-up
      1
      ·
      10 hours ago

      I disagree.

      CA pinning has nothing to do with DNS.

      CA pinning makes it harder to inspect the content of the connection e.g. via a Man-in-the-middle attack. But DNS-based blocking is not affected.

    • x00z@lemmy.world
      link
      fedilink
      English
      arrow-up
      2
      arrow-down
      2
      ·
      9 hours ago

      ECH has nothing to do with DNS.

      DNS and DNS adblockers come before the ClientHello.

      ECH is meant to make the wanted virtual host known without sending it as plaintext in the ClientHello.

      Please refrain from commenting again.