you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 2 months ago (1 child)

You're absolutely right: adblockers (even via pi-hole) will be ineffective.

Not mentioned in this article, but ECH lays the foundation for each application to decide if they trust the upstream DNS provider or not.

Normally, an app trusts all pre-installed CAs. If any of these CAs were to issue a fraudulent certificate, the app would be at risk from an on-path attacker. Some apps choose to limit the set of certificates they accept by either limiting the set of CAs they trust or by certificate pinning.

Source

So using custom DNS to block/prevent unwanted updates and to block ads will be a thing of the past.

...but this does mean if your ISP or country is censoring the internet: their job has gotten much more difficult.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 4 points 2 months ago

    ECH has nothing to do with DNS.

    DNS and DNS adblockers come before the ClientHello.

    ECH is meant to make the wanted virtual host known without sending it as plaintext in the ClientHello.

    Please refrain from commenting again.

  • source
  • parent