Oblivious HTTP
Oblivious HTTP (OHTTP) is an IETF network protocol intended to enable anonymous HTTP transactions over the Internet.[1] Its goal is to allow a user to send an HTTP request to a web server without allowing any single entity to see both the content of the request and the sender's IP address, since the IP address could be connected to the identity of the sender.[2] OHTTP is documented in RFC 9458, published in January 2024 by authors affiliated with Mozilla and Cloudflare.[3] The RFC says "Oblivious HTTP is simpler and less costly than more robust systems, like Prio or Tor, which can provide stronger guarantees at higher operational costs."[3] Some technology companies and other online service providers have implemented OHTTP to improve Internet privacy for users, typically for specific use cases such as collecting software metrics from client devices, collecting user data for targeted advertising, or processing client requests for use of artificial intelligence services. The privacy protections in the OHTTP protocol rely on two separate entities handling different aspects of each client request, so service providers interested in deploying OHTTP generally partner with a different company. For example, Cloudflare and Fastly provide OHTTP relay services, and Apple, Google, Meta, and Mozilla partner with one or both relay services for their OHTTP implementations. MechanismHTTP is the foundation of communication for the World Wide Web. By default, HTTP exposes a website user's IP address to the operator of the website, which may enable the operator to gather a profile of information about the user.[3] OHTTP is one of several protocols designed to protect the privacy of users making requests to web servers, using the principle of privacy partitioning (also called decoupling) to hide IP addresses.[4][5] OHTTP is designed for simple transactions, such as sending web analytics information, rather than general-purpose web browsing.[6][7] Most implementations of OHTTP involve an application, such as a mobile app, pre-configured to reach out to an OHTTP service for a particular type of transaction.[8]  OHTTP protects user privacy by combining message encryption and specially-designed proxy servers. First, the client uses hybrid public key encryption (HPKE) to encapsulate the content of a HTTP request.[9] Then, the client sends the encrypted request to a relay, which can collect the client IP address but cannot decrypt the message.[3] The relay forwards the encrypted message to a gateway, which can decrypt the message but cannot find out the client IP address.[3] The gateway sends the decrypted request to a server for processing.[3] All traffic between the source, relay, gateway, and target server is sent over HTTPS to prevent third parties from analysing or intercepting the message contents.[10] Since neither the relay nor gateway knows both the source IP address and the content of a request, the relay and gateway would need to collude to cross-correlate messages and de-anonymize them.[9] If either of the operators is trustworthy, privacy is preserved. However, if both operators collude, they can compromise the privacy guarantees of OHTTP.[9] The gateway and target server are typically operated by the same organization, while the relay is typically operated by a different organization to prevent collusion.[11] An analysis by NCC Group of an OHTTP implementation also noted that, to reduce risk of traffic analysis and other attacks, "Deployment of OHTTP requires careful management of key rotation, rate limiting, and tolerances against network delays."[12] Client applications configured to use OHTTP, such as applications designed to use OHTTP for certain API calls, do not need to try to find out whether OHTTP is available from a server.[8] In other cases, if a server operator wants to tell clients that a service supports OHTTP, RFC 9540 (February 2024) defines an optional DNS resource record parameter.[8] This mechanism enables a client to discover, after sending a DNS request, that they can send OHTTP requests, although the initial DNS request could expose the client's IP address to the server if not otherwise hidden.[8] DeploymentsCloudflare released an OHTTP relay service in 2022, called Privacy Gateway.[13][9] Flo, an app for tracking menstrual cycles, uses Cloudflare's OHTTP service to offer an "Anonymous Mode" that enables entering data into Flo without providing personally identifying information.[14] Google contracted with Fastly in 2023 to provide Google with an OHTTP relay to implement its experimental anonymous advertising technology.[15][16] Specifically, Google used OHTTP to help ensure k-anonymity for its Privacy Sandbox initiative.[17] Google also uses a Fastly OHTTP relay as part of its Google Safe Browsing service.[18][19] Google offers a Safe Browsing Oblivious HTTP Gateway API that enables client applications, such as web browsers, to check whether a URL is on Google's list of unsafe websites without revealing the requester's IP address to Google.[20] In 2023, Mozilla started using Fastly's OHTTP relay service as part of collecting Firefox performance metrics without collecting identifying information about individual users.[21][22] As of 2024, Apple uses OHTTP in its Private Cloud Compute platform to conceal IP addresses associated with requests to Apple Intelligence tools.[23] Apple published support for OHTTP for its Swift programming language in 2024.[24] Apple said in 2025 that its Enhanced Visual Search uses OHTTP as part of its anonymization strategy.[25][26] The Internet Security Research Group includes an OHTTP gateway in Divvi Up, a service that enables subscribers to collect software metrics from user devices while collecting minimal identifying information about users.[11] As of 2025, Meta Platforms uses OHTTP in its "Private Processing" functionality for Meta AI tools, including to enable WhatsApp users to request summarization of messages without exposing the requester's IP address to Meta.[27] This uses Fastly's OHTTP relay service.[12] Related technologies
An IETF working group, Oblivious HTTP Application Intermediation (OHAI), is responsible for working on OHTTP standards and collaborating with groups that work on related protocols.[1] The Oblivious DNS over HTTPS (ODoH) protocol enables making Domain Name System (DNS) requests using similar architectural principles as OHTTP (RFC 9230, June 2022).[10] Some people use virtual private network (VPN) services to address privacy concerns, but this enables a single entity to see identifying information about the user and all of their activity that passes through the VPN.[4] Tor is a separate technology for protecting user privacy on the web by decoupling the sender from the receiver through at least three intermediate hops.[4] MASQUE (Multiplexed Application Substrate over QUIC Encryption) is a different set of protocols for improving the privacy of users making web requests.[28] It can be used for web browsing.[7] For example, Apple's iCloud Private Relay service uses MASQUE.[29] See alsoReferences
|
||||||||||||||||||||
