I-HTTPS, i-DoH, i-ECH ne-VPN kufihla izinto ezihlukene
Indlela ngayinye isusa umqaphi ohlukile endleleni futhi akekho osusa bonke. Qhathanisa okugadiwe ngaphambi kokwengeza omunye umhubhe.
Ukufaka i-VPN kusiphequluli esivele sisebenzisa i-HTTPS, i-DoH ne-ECH akuhlanganisi izivikelo ezintathu zibe eyodwa; kushintsha ukuthi ubani usesimweni sokubona ini. Indlela ngayinye isusa uhlangothi oluhlukile ekushintshaneni okuhlukile, futhi ngayinye ishiya okuthile. Umbuzo owusizo akuwona ukuthi iyiphi eqinile kakhulu kodwa ukuthi uwususa muni umqaphi, ngoba impendulo inquma ukuthi umhubhe usiza nhlobo yini. Ukuqhathanisa abaqaphi abasele kusiza ngaphezu kohlu lwezici.
Izindlela ezine, abaqaphi abane
Qala ngobudlelwano obune kanye nohlangothi indlela ngayinye eklanyelwe ukulugcina ngaphandle. Ithebula elingezansi yilona engilisebenzisa ekubuyekezweni, ngoba liphoqa ingxoxo ukuthi ibize umqaphi esikhundleni sobuchwepheshe.
| Mechanism | Relationship it protects | Observer it does not remove |
|---|---|---|
| HTTPS | The application's TLS connection to its named endpoint | The access network still sees the destination address |
| DoH | The DNS exchange to the selected HTTPS resolver | That resolver sees every query |
| ECH | The sensitive ClientHello fields, where supported and accepted | Destination addresses, and DNS if it is not covered |
| VPN | Covered packets carried to the VPN peer | The VPN operator sees the destinations |
Inani lethebula yilokho elinqaba ukukusho. Alihleli izindlela ngokwezigaba, futhi alisho ukuthi ukusebenzisa zone ezine kususa abaqaphi bone. Uhlelo lwewebhu lwefu olusuke luqeda i-TLS onqenqemeni lwalo luvikelwe kunethiwekhi yokufinyelela kulokho kushintshana, futhi awukho umhubhe othuthukisa leso sici. Umhubhe ungashintsha ukuthi iyiphi inethiwekhi ebona amaphakethe angaphandle kanye nokuthi ubani ophethe manje osendleleni.
I-HTTPS ifihla ini ngempela
I-HTTPS ivikela ukushintshana kohlelo phakathi kweklayenti nendawo yokugcina ebiwa isitifiketi. Ayifihli ikheli lendawo eya kuyo, ayifihli ukuthi kwenzeke ukuxhumana, futhi ayifihli igama ngaphandle uma i-ECH ikhona. Ukuqinisekiswa kwesitifiketi kuyingxenye yokuvikela, akusona isiko elizungezile.
I-VPN akudingeki iqede leyo TLS, futhi umkhondo wokuphuma odluliselayo akufanele uthathwe njengendawo yokugcina eqinisekisiwe yohlelo. Uma umklamo uvumela umkhondo wokuphuma ukuthi uqaqe, lowo ngumklamo ohlukile onesitatimende sokuthembela esihlukile.
I-DoH ne-ECH zihambisa ini, futhi zishiya ini
I-DoH ihambisa ukushintshana kwe-DNS kusihlukanisi se-HTTPS, okusho ukuthi leso sihlukanisi sibona imibuzo yakho esikhundleni sesihlukanisi senethiwekhi yendawo. Lokho ukushintsha kwangempela nokulinganiselwe: isihlukanisi esikhethiwe siba uhlangothi olungahlobanisa imibuzo namakheli oxhuma kuwo kamuva, okuyikho kanye ukuhlobana okuxoxwa ngakho embhalweni we-RFC 8484. Ukuthutha okubethelwe akumenzi umamukeli angazi imibuzo ayiphendulayo.
I-ECH ivikela ingxenye ebucayi ye-ClientHello ukuze umqaphi ongenzi lutho osendleleni angakwazi ukufunda igama leseva okuhloswe ngalo. Kuncike ekusetshenzisweni okusekelayo nasekwamukelweni yiseva nenethiwekhi, futhi ishiya ezinye iziteshi zikhona: amakheli endawo eya kuyo asabonakala, futhi i-DNS isengaveza igama.
Enye into i-ECH engayenzi ukuzifakazela yona. Ukuxhumana okusebenzisa i-TLS 1.3 akusona ubufakazi bokuthi i-ECH yamukelwe, futhi isiphequluli esinikela nge-ECH kuseva engayisekeli sihlehla buthule. Hlola isimo sangempela sokuxhumana esikhundleni sokucabangela kusukela kunguqulo yeprothokholi.
Yilokho ukuma okujwayelekile kwakho konke ukuqhathanisa: indlela ngayinye iqinisekiswa esigabeni sayo, futhi akukho okuthi iqinisekiswe ngempumelelo yomunye.
I-VPN ihambisa ini, futhi yengeza ini
Uma ithrafikhi yewebhu ingena ku-VPN, inethiwekhi yokufinyelela ibona ukushintshana kwangaphandle nozakwabo we-VPN esikhundleni sezixhumanisi zohlelo ngazinye, futhi umqhubi we-VPN uthatha indawo endleleni eqhubekayo. Lokho ukuhambisa umngcele wokuthembela, hhayi ukuwususa. Umqhubi manje ubona ukuthi yiziphi izindawo ozifikayo, ngisho noma okuqukethwe kusalotshwe kusukela ekupheleni kuya ekupheleni. Ukuthi lokho kuwukuthuthuka kuncike ngokuphelele ekutheni yiluphi kulaba laba ababili omethemba kancane.
Gcina i-HTTPS yohlelo nokuvikelwa kwesihlukanisi okuhloswe ngakho ngenkathi wenza lokhu. Umhubhe awusona isikhundla sokufaka esikhundleni sokuqinisekiswa kwesitifiketi, futhi ukucisha izivikelo zesihlukanisi ngenxa yokuthi ithrafikhi ihamba ngomhubhe kususa isilawuli ngaphandle kokufaka esinye.
Ukukhetha kusuka ekudingekayo
Shono isidingo sangempela, ngoba yiso esinquma umklamo. Ukwamukelwa ezinsizeni eziyimfihlo, indawo yokuphuma elawulwayo, usongo oluthile lwenethiwekhi yokufinyelela nokugunyazwa kwedivayisi yizidingo ezine ezihlukene ezinezimpendulo ezine ezihlukene, futhi inkampani esebenzisa kuphela izinhlelo zewebhu zamafu omphakathi isadinga ukunquma ukugunyazwa nokuphathwa kwedatha. Izendlalelo ezengeziwe zingafaneleka ngaphandle kokushintshana. Ukuxhumana okuyinkimbinkimbi kakhulu akusona isilinganiso sokungaziwa, futhi akusona ngokwaso impikiswano yokuphepha.
Isicaciso se-ECH, i-RFC 9849, kufanele sifundwe ngalokho indlela ekuhlanganisa nalokho engakuhlanganisi, futhi ithembekile ngeziteshi eziyeka zodwa. Qhathanisa izindlela ngomoqaphi oyisusa ngayinye, bhala lowo mqaphi, bese unquma ukuthi ingabe isendlalelo esengeziwe sibhekene naye. Uma impendulo ingukuthi umqaphi wayesekade engaphandle kwemodeli yakho yezinsongo, umhubhe uyindleko engenanzuzo.