Disabling Encrypted ClientHello in Google Chrome, and Why

by new23don 10/9/2023, 6:02 PMwith 5 comments

by new23don 10/9/2023, 6:02 PM

Google Chrome v117 turned on TLS Encrypted ClientHello by default (on 27 Sep?) This will impact the effectiveness and accuracy of outbound traffic filtering* - for those who've implemented it (regardless of vendor.) We've written a short blog post on disabling it with PowerShell, Windows Registry and Google Chrome UI for those who may need to roll this out ASAP and regain visibility. (Disclosure: we are a vendor of an outbound filtering solution and this has impacted our customers already.)

*for many websites, the domain name visibility during an HTTPS handshake will no longer be available to firewalls/proxies (unless they were terminating.)

by evanjrowleyon 10/9/2023, 6:56 PM

DiscrimiNAT Firewall seems like a useful product: https://chasersystems.com/

Reminds me somewhat of Zscaler.

by josephcsibleon 10/9/2023, 10:06 PM

The fact that it's possible for a middlebox to detect ECH at all is a flaw in the protocol, IMO.