Firefox and Fastly take another step toward a privacy upgrade for the internet

How does Oblivious HTTP (OHTTP) work? 

OHTTP is a spec and service architecture that engineers can use to enable more private communications between two parties by splitting the information about the requester from the information of the request being made. You can read more about OHTTP here, but the basic idea is that it is “double-blind” in the sense that the spec is designed so that there is never a single party who has all of the information about who is making a request, and what the request is. When OHTTP is not in use all of that data is mixed together, which leaves room for abuse or misuse, and also means that a malicious attack could gain access to that data. With OHTTP a new level of privacy is guaranteed. 

Fastly serves as the OHTTP Relay, receiving a request from the OHTTP client (in this case it would be in the browser), that includes metadata about the requester which Fastly can read and strip away, as well as an encapsulated and encrypted request that is passed along through the relay as designed. Fastly never knows what information is in the request itself, and Mozilla never knows any of the metadata about the requester. 

Browsers are the beginning

The double blind communication enabled by a new generation of private-by-design technologies are impossible with HTTP alone. We believe that OHTTP, MASQUE*, and DAP** represent the beginning of a more private and secure future for all communications on the internet. Browsers occupy an important position, sitting between users and a great deal of their activity on the internet. When Firefox and other browsers adopt new technologies like this it sends an important signal that this level of privacy-by-design should be table-stakes going forward.

Working toward a more private internet 

This technology is still relatively complicated to implement, being adopted by larger organizations like the most popular browsers, but we are getting a glimpse of a future where more is possible. We have seen this before with the adoption of HTTPS, which is now expected and the default – not just for business and large organizations, but even for small personal websites. 

Fastly views the work to bring OHTTP and other privacy protecting technologies to browsers and apps as a fundamental, necessary first step. Connected/smart device manufacturers, network hardware companies, and the consumer electronics industry at large are becoming more serious about compliance and privacy. And with the help of organizations like Mozilla, we are laying the groundwork for a future where applications – even smaller ones without the resources of an Apple, Google, Microsoft, or Mozilla, will be able to access OHTTP simply. We won’t arrive at this state tomorrow, but we are starting to have options for how to get there. 

Our goal is to create a future where all internet communications are private through the democratization of these private-by-design technologies. We must start with specific use cases and particular protocols with organizations like Mozilla who share this vision, and are ready to be early adopters. Over time the aim is to broaden the use of the technology as the private communication pathways are more universally available and easy to use. We expect this to be pushed forward in at least a couple ways – first, by continued regulatory moves and privacy legislation that forces adoption of these kinds of technologies. Second, we expect it to evolve to be a standard that users expect, like the lock in their URL bar for HTTPS connections. This is the commoditization of privacy in a great way, where improved privacy becomes cheap to the point that it is only a negligible cost to adopt an improved standard, and a reputational cost if you don’t adopt it. 

Fastly will not be the only option for providing a relay for this type of feature, but we do intend to be the best option. We intend to be the change we want to see in the internet and move all of us toward a future of complete privacy in internet traffic. 

*MASQUE = Multiplexed Application Substrate over QUIC Encryption

**DAP = Distributed Aggregation Protocol (for privacy preserving measurement)