Okungabonwa nokungabonwa umhlinzeki wakho we-VPN
Indawo yokuphuma ibona amakheli, izikhathi futhi, ngaphandle uma kusetshenziswa Encrypted Client Hello, igama lesiza ekuxhumaneni ngesandla kwe-TLS. Ukugcinwa kuwumbuzo ohlukile.
Umhubhe wakho ugcina inethiwekhi yasendaweni ingaphandle kothungo lwakho. Kodwa awususi inkampani ekwelinye uhlangothi, esebenza kuyo yonke iphakethe ngaphambi kokuba ifike ku-inthanethi evulekile. Leso sikhundla siyimodeli yebhizinisi futhi siwumbuzo wemfihlo. Ngakho umbuzo owusizo awuwona ukuthi umhlinzeki angakubona yini, kodwa ukuthi ubona ini, angashiwo ini nokuthi ugcina ini.
Lapho ukuthembana kudlulela khona ngempela
Ukubethela kuhamba kusuka kudivayisi yakho kuya kuseva yomhlinzeki, futhi leyo ngxenye yangaphandle yikho konke okubonwa inethiwekhi yakho yasendaweni. Umhlinzeki ubamba elinye iphethelo lale ngxenye, ngakho uyavula umhubhe futhi udlulise amaphakethe akho. Akukho sici kulokho; yincazelo yensiza oyithengile. Ukuthembana kwadlula kusuka kumqhubi wasendaweni kuya kumqhubi wendawo yokuphuma esikhundleni sokunyamalala.
Kusuka kuleso sikhundla ufunda ikheli lakho lomthombo, ukuthi uxhume nini, cishe ungakanani owukudlulisile nokuthi yiziphi izindawo oxhumene nazo. Akukho kulokhu okudinga ukufunda imiyalezo yakho, futhi yilokho okushiwo ukwehlukanisa izigaba. Umehluko othakazelisayo phakathi kwabahlinzeki umayelana nokuthi kwenzekani kulezo ziqaphelo ngemuva kwalokho.
Okusingathwa yindawo yokuphuma ngokudingekayo
Hlela izigaba ngokuthi indawo yokuphuma ingazibona ngokuthembekile kangakanani. Awukho umugqa odinga ukuphula ukubethela, futhi ngamunye unempendulo ehlukile mayelana nokuthi kungagwenywa yini ngokuphelele.
| Category | Visible at the exit | Why |
|---|---|---|
| Your public address | Always | It is the address the tunnel arrives from |
| Connection times and volume | Always | Accounting data, not content |
| Destination IP addresses | Always | The exit has to route the packets |
| HTTPS hostname (SNI) | Normally, unless ECH is used | Sent in the clear in the TLS ClientHello |
| DNS names | Only if DNS is plaintext | DoH or DoT hides the query; plaintext is readable by the forwarder |
| Page paths and form contents | Not normally | Protected by the destination site's TLS session |
Umugqa wesine yikho okudlulwa amamodeli amaningi engqondo. Isiphequluli sesimanje sibeka igama lesiza ku-ClientHello, umyalezo wokuqala wokuxhumana ngesandla kwe-TLS, futhi leyo nkambu iyafundeka endaweni yokuphuma ngisho lapho wonke umbuzo we-DNS ubethelwe kusuka ekugcineni kuya ekugcineni. Ngaphandle uma kuxoxiwe nge-Encrypted Client Hello, igama lihamba obala eceleni kwekheli lendawo. I-DNS ebethelwe ishintsha ukuthi ubani obona umbuzo, hhayi ukuthi ubani obona igama.
Kunjalo futhi ngezitifiketi ekuxhumaneni okudala: i-TLS 1.3 ibethela isitifiketi seseva, kuyilapho ukuxhumana ngesandla kwe-TLS 1.2 kungadalula igama kumbukeli oqopha umfudlana. Kokubili kungamaqiniso okuthutha, hhayi inqubomgomo yomhlinzeki.
I-TLS imboza ini futhi ayimbozi ini
Lapho isiza siletha i-HTTPS, isiphequluli sakho sakha ukuxhumana kwe-TLS nendawo yokugcina yaleso siza, hhayi neseva ye-VPN. Umhlinzeki udlulisa amarekhodi abethelwe futhi ufunda ikheli lendawo, isikhathi nosayizi abalinganiselwe. Igama lesiza lihamba ku-ClientHello ngaphandle uma i-ECH isebenza, futhi umzimba wekhasi uhlala ubethelwe kuzo zombili izimo. Isitifiketi sikawoyise esingalindelekile sishintsha lowo mkhawulo, ngakho izexwayiso zesitifiketi zifanele inhlonipho.
I-HTTP elula ayinalo ukuvikela okunjalo ngemuva kwendawo yokuphuma. Umhubhe uvikela ingxenye eya kumhlinzeki, futhi ngemuva kwalokho isicelo sihamba ngendlela efanayo nokube sasihamba ngayo ngaphandle kwe-VPN. I-ECH ayikulungisi lokho, ngoba ivikela igama hhayi okuqukethwe.
Ukugcinwa kuwumbuzo ohlukile ekubonakaleni
Umqhubi angase acubungule idatha yokuxhumana ememori futhi angagcini lutho, noma agcine isethi encane futhi ayichaze ngokunemba njengokungeyona umlando wokuphequlula. Funda isimangalo sokungabi namanani ngokwezigaba hhayi ngesiqubulo: amarekhodi okuxhumana, izigxivizo zesikhathi, isamba somthamo, idatha yendawo, izihlonzi zekhasi nemiyalezo yosizo konke kubalwa. Umhlinzeki angase ngokwethembeka angabi namanani okuphequlula futhi ngesikhathi esifanayo agcine irekhodi lekhasi nedatha yemetha edingekayo ukuze asebenze. Ukubonakala akukutsheli ukuthi iyiphi yale zigaba egciniwe.
Ucwaningo luwubufakazi mayelana namasistimu nesikhathi esikubambile, futhi ikhodi yeklayenti yomthombo ovulekile ichaza iklayenti hhayi amaseva. Kokubili kuyasiza, futhi akukho okukhulumela wonke amasistimu okugcina ngemuva kwendawo yokuphuma. Buza ubukhulu bocwaningo, hhayi ibheji yalo.
Imibuzo ehlukanisa abahlinzeki
Buza ukuthi kugcinwa ini, isikhathi esingakanani nokuthi ubani angakuthola. Buza ukuthi ubani oqhuba indawo yokuphuma, ngoba ukufakwa kuhlu lwemibhalo, umthuthukisi wohlelo lokusebenza kanye nomuntu oqhuba iseva ethile bangaba yizinhlangothi ezintathu ezihlukile. Buza ukuthi i-DNS isingathwa kanjani nokuthi i-ECH iyasekelwa yini emizileni oyisebenzisayo, ngoba i-ClientHello yombhalo ovulekile isho isiza ngisho ngaphandle kombuzo we-DNS. Buza ukuthi kwenzekani esicelweni somthetho, futhi funda impendulo njengencazelo yekhono hhayi yenhloso.
Umhlahlandlela we-EFF wokukhetha i-VPN uwuhlu lokuhlola olunengqondo lwale mibuzo, futhi uyuhlaka hhayi isinqumo nganoma yiluphi usizo. Ikhasi lokumaketha akulona inqubomgomo yokugcina. Akukho kulokhu okwenza i-VPN ibe engenamsebenzi; kushintsha ukuthi ubani okufanele umethembe, nokuthi ngani.