FWIW, Cloudflare has enabled ECH by default.

I think this wouldn't be very useful as a security measure:

• When authenticating with cookies, all cookies use the Secure flag already, so a reasonable client would not send them over HTTP.
• OAuth 1 is designed to be secure over HTTP.
• The OAuth 2 spec forbids serving HTTP requests, so if we allow them currently, we should stop doing that. There is some value in key revocation but I'm not sure if it's worth the effort - you'd need to avoid write on GET, notify the user somehow, it's easy to cause mass breakage by revoking keys which don't need to be revoked (SSL is terminated way before the request reaches the appserver so MediaWiki can't directly check what protocol is being used), hard to do consistently (how would non-MediaWiki APIs revoke?).

Tagging MW-Interfaces-Team as they are API owners.

@Vgutierrez: Removing task assignee as this open task has been assigned for more than two years - see the email sent to all task assignees on 2024-04-15.
Please assign this task to yourself again if you still realistically [plan to] work on this task - it would be welcome! :)
If this task has been resolved in the meantime, or should not be worked on by anybody ("declined"), please update its task status via "Add Action… 🡒 Change Status".
Also see https://www.mediawiki.org/wiki/Bug_management/Assignee_cleanup for tips how to best manage your individual work in Phabricator. Thanks!

This only affects CentralAuth in a non-WMF configuration, which we don't support.

Hi @DennisJJackson: Thanks for the question. We do plan to work on ECH and enable it for our sites and have had some discussions internally. There is no timeline yet as such, for a variety of reasons, the limited browser support being one, though that has clearly changed over the past few weeks. There are some other considerations here as well such as the lack of server-side options for turning it on but we are hoping the DEfO project will provide the much needed support there for HAProxy, which is what we use for TLS termination.

@Aklapper - It looks like this issue was originally raised several years ago and put in the icebox. I'm flagging that the situation around standardization and deployment of ECH has changed rather dramatically since then. This work would also be closely aligned with Wikimedia's recent work on hosting secure DNS.

@DennisJJackson Hi and welcome to Phabricator! What in this ticket led you to asking for "retriage" (and what does that mean)?

Mozilla have now launched ECH in Firefox. Cloudflare have also launched server side support globally. Chrome will be shipping ECH imminently.

Removal is already in progress via T338183

In T87276#8784283, @Xover wrote:

This is still spewing errors in the console for every page load in Safari due to the hyphenless keyword. But cf. T180921 and T178356, are there any still-supported UAs that need (and do something sensible with) the old version of the keyword? That actually support current SSL/TLS versions and options (i.e. can actually connect)? Can we get rid of it? (finally, after eight years)

Dunno how but it works again.

The certificate for upload.wikimedia.beta.wmflabs.org expired on May 17, 2023.

Resolving since it appears to be finished. Thanks all!

New internal certs now include wikifunctions.org and *.wikifunctions.org

Mentioned in SAL (#wikimedia-operations) [2023-05-02T15:36:13Z] <claime> Re-running puppet on failed parse servers - T313227

Change 914357 merged by Clément Goubert:

[operations/puppet@production] ssl: Fix parsoid.svc.{codfw,eqiad} pubkeys

https://gerrit.wikimedia.org/r/914357

Change 914357 had a related patch set uploaded (by Clément Goubert; author: Clément Goubert):

[operations/puppet@production] ssl: Fix parsoid.svc.{codfw,eqiad} pubkeys

https://gerrit.wikimedia.org/r/914357

Mentioned in SAL (#wikimedia-operations) [2023-05-02T14:33:24Z] <claime> Merging new internal certs for api, jobrunner, appservers, parsoid - T313227

Change 914339 merged by Clément Goubert:

[operations/puppet@production] ssl: Update api,jobrunner,appservers,parsoid certs

https://gerrit.wikimedia.org/r/914339

Change 914339 had a related patch set uploaded (by Clément Goubert; author: Clément Goubert):

[operations/puppet@production] ssl: Update api.svc, jobrunner.svc, and appservers.svc certs

https://gerrit.wikimedia.org/r/914339