It uses a relay (so similar to VPNs or Tor), and asymmetrical cryptography to encrypt the final request to the server (so no man in the middle, even when no HTTPS).
It has some limitations though, mainly that, if I understand correctly, the HTTP server needs to be aware of the protocol and implement it, and also, it's saying it can't relay cookies? (that would be a severe limitation, meaning no using it for a website where you're logged in). I'm unsure if they say cookies can't be used, or using cookies negates the benefits (one of their goal being to make subsequent requests not identifiable). Tor still seems like the best choice for #privacy , but it's nice to see the matter being worked on by the #IETF
Also worth noting that the authors are from Mozilla and Cloudflare.
Add comment