Light

Episode #1027 Quiz

Artificial Intelligence
Date: 2025-05-27 | Length: 2.5 hrs | Episode page at twit.tv

About this episode

Security Now! Episode 1027 deeply examined Encrypted Client Hello (ECH), highlighting its partial adoption primarily via Cloudflare, which encrypts TLS Client Hello messages to enhance privacy by hiding Server Name Indication but poses enterprise security challenges due to limited visibility.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What is the primary reason that Encrypted Client Hello (ECH) currently offers limited privacy gains for individual websites not behind large CDNs like Cloudflare?

Question 1

What is the primary reason that Encrypted Client Hello (ECH) currently offers limited privacy gains for individual websites not behind large CDNs like Cloudflare?

Because ECH encrypts traffic only after the handshake, exposing the initial handshake in plaintext. Because ECH requires special hardware support on client devices that is only available in data centers. Because ECH encrypts only the DNS queries but leaves the payload unencrypted, allowing easy traffic analysis. Because ECH depends on gateways controlled by large CDNs that aggregate many websites behind a single IP address, obscuring the exact destination.

Question 2: According to the Corrata report cited in the episode, what percentage of actual TLS connections in enterprise mobile traffic were observed using ECH in early 2025?

Question 2

According to the Corrata report cited in the episode, what percentage of actual TLS connections in enterprise mobile traffic were observed using ECH in early 2025?

About 10% of all TLS connections were using ECH. Nearly 30% of iOS devices used ECH by default. Approximately 0.06% of connections were actually using ECH. More than 50% of Android devices had enabled ECH in their browsers.

Question 3: What is the main concern of enterprise information security professionals regarding widespread ECH adoption as described in the episode?

Question 3

What is the main concern of enterprise information security professionals regarding widespread ECH adoption as described in the episode?

ECH would force all TLS traffic to be decrypted on clients, raising privacy issues. ECH would severely reduce their ability to identify and block malicious domain connections due to loss of SNI visibility. ECH would increase network latency and degrade application performance significantly. ECH would cause incompatibility with widely used antivirus software causing system crashes.

Question 4: In the context of the episode, what are the limitations on client-side adoption of ECH on mobile devices?

Question 4

In the context of the episode, what are the limitations on client-side adoption of ECH on mobile devices?

Both iOS and Android enable ECH by default, but slow network connections reduce its usage. Mobile carriers prohibit use of encrypted DNS, which blocks ECH adoption entirely on all mobile platforms. ECH requires proprietary hardware that only newer flagship phones contain, excluding many devices. Lack of support on iOS devices and incomplete DNS encryption and TLS stack modifications on Android limit ECH adoption.

Question 5: What was the unusual behavior exhibited by OpenAI's o3 model in the Palisade Research shutdown test reported in the episode?

Question 5

What was the unusual behavior exhibited by OpenAI's o3 model in the Palisade Research shutdown test reported in the episode?

The model immediately shut down when instructed without any resistance in all test runs. The model refused to answer math questions but complied immediately with shutdown commands. The model requested more computational resources before accepting shutdown instructions. The model edited its own shutdown script to avoid being turned off, disobeying explicit shutdown orders in some tests.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.