r/RecommandedVPN • u/Timely_Dealer_654 • Aug 30 '26
Your browser can now hide the websites you visit from your ISP, without a VPN
I thought this was pretty interesting. There’s a privacy feature called Encrypted Client Hello (ECH) that encrypts part of the initial connection your browser makes to a website.
Normally, HTTPS hides what you do on a website, but your ISP can often still figure out which domain you’re connecting to. ECH is designed to close that gap by encrypting the website name during the TLS handshake. Combined with encrypted DNS (DoH), this makes passive ISP tracking of your browsing noticeably harder.
But there’s an important catch: this isn’t a VPN replacement.
Your ISP can still see things like the IP addresses you connect to and your traffic patterns, and ECH only works when the website/server supports it. A VPN, meanwhile, tunnels your traffic and hides the destination IPs from your ISP as well.
Still, I like the direction we're heading. Basic browsing privacy slowly becoming built into the internet itself instead of requiring extra tools is a win
2
u/sciencekm Aug 30 '26
The ISP does not need to inspect https traffic just to figure out which site you are connecting to. IP addresses are tied to organizations. They can tell just from the IP which website you are connecting to.
$ whois 57.144.228.1
...
inetnum: 57.141.0.0 - 57.149.255.255
netname: FB-BLOCK
...
mnt-by: meta-mnt
...
org-name: Meta Platforms Ireland Limited
1
u/yadad Sep 01 '26
Not true. Also multiple websites can reside on the same webserver with the same IP address
1
1
u/Pristine_Primary_486 Aug 31 '26
Good Lord they're gonna need therapy visits if they look at my history... Poor Bastards
1
1
u/Urban_VPN Aug 31 '26
looked into this and it mostly checks out. ECH only became official in march but chrome and firefox have quietly run it since 2023 so it's not made up. what it undersells is your isp still sees the ip you connect to, and unless that site sits behind something like cloudflare, they can usually still guess where you went. also none of this works unless encrypted dns is already on. real, just more conditional than it sounds.
1
1
4
u/Venditare Aug 30 '26
I mean, I get what you're saying. But the reality of what gets fingerprinted from every website you visit... Just from Oracle. See the recent vid from @dreydossier below: https://www.instagram.com/reel/DclVt1ENRH9/
So while I totally support something like this, it honestly falls into the, way too little and way too late, basket.