All about Cloudflare ECH: How it works and how to activate it

Informatec Digital » The Cloud » All about Cloudflare ECH: How it works and how to activate it

Internet privacy has become a priority for businesses and users. One of the most important advances in this field is ECH ( Encrypted Client Hello ) , an extension of the TLS protocol that protects the domain information being accessed, preventing operators and other entities from spying on the connection.

Thanks to ECH, the filtering systems used by internet service providers to restrict access to certain websites become ineffective , resulting in safer and more private browsing. But how does this technology actually work? Is it easy to activate in browsers like Chrome and Firefox? Below, we explain everything about ECH in detail.

What is ECH and why is it important?

ECH, or Encrypted Client Hello , is an improvement to the TLS ( Transport Layer Security ) protocol that prevents sensitive information, such as the domain name being accessed, from being exposed in plain text during the connection negotiation phase.

When a secure connection is established using TLS, the browser sends an initial message called "Client Hello" specifying the website it wants to connect to. Before ECH, this message included the server name in plain text (SNI – Server Name Indication ), allowing third parties to see which website the user was visiting.

With ECH, this information is encrypted using public keys obtained through the DNS system, preventing intermediaries from reading it. This represents a significant improvement in privacy, as neither operators nor governments can easily inspect and block access to certain websites.

How does ECH work?

The ECH procedure is based on dividing the “Client Hello” message into two parts:

• ClientHelloOuter: Contains non-sensitive information such as TLS version and supported encryption algorithms.
• ClientHelloInner: Contains the actual name of the server you want to connect to and other sensitive data, but is encrypted with a specific public key.

Cloudflare has been one of the first companies to implement this technology on its server network, allowing websites that use its infrastructure to offer ECH protection to their users.

Does ECH completely prevent website blocking?

Over the years, operators have used different methods to block websites, first through their DNS servers and then by inspecting traffic using the TLS SNI field. With the arrival of ECH, this last method becomes obsolete, as SNI is now encrypted.

However, operators can still implement blocks using other techniques, such as IP address analysis. On distribution networks like Cloudflare, where many websites share the same IP address, this becomes more complicated.

To further enhance privacy, it is recommended to use ECH in combination with DNS over HTTPS (DoH) and VPN networks , as these tools make it even more difficult to identify and filter web traffic.

How to enable ECH in Google Chrome

If you want to enable ECH in Chrome, follow these steps:

1. Make sure you have Chrome updated to the version 117 or higher.
2. Type in the address bar: chrome :/ / flags and press Enter.
3. Find and enable the following options, marking them as “Enabled”:
   • encrypted-client-hello
   • dns-https-svcb
   • use-dns-https-svcb-alpn
4. Go to “Settings” > “Privacy & security” > “Security”.
5. Enable “Use Secure DNS” and select Cloudflare as your provider.
6. Restart the browser to apply the changes.

How to enable ECH in Mozilla Firefox

To enable ECH in Firefox, follow these steps:

1. Type in the address bar: about: config and press Enter.
2. Search for “echconfig” and make sure it is set to “true”.
3. Enable DNS over HTTPS from “Settings” > “Privacy & Security”.
4. Select Cloudflare as your provider Secure DNS.
5. Restart the browser.

Advantages and disadvantages of using ECH

Although ECH is a crucial improvement for privacy , it has some advantages and disadvantages that should be taken into account.

Advantages

• More privacy: Prevents intermediaries from seeing which sites we access.
• Increased levels of security throughout: Reduces the risk of censorship and blocking by governments and operators.
• TLS support: Easily integrates with existing encryption protocol.

Disadvantages

• Incompatibility: Some servers do not yet support ECH.
• Requires configuration: Currently it must be manually activated in many browsers.
• May affect performance: Additional encryption may cause slight connection delays.

ECH represents a major advance in internet privacy and security, as it prevents third parties from seeing which websites we visit, closing one of the last remaining vulnerabilities in TLS. Although still in the adoption phase, its implementation in Cloudflare and browsers like Chrome and Firefox marks the beginning of a new era in online traffic protection.