Open implementations and interoperability work for privacy-preserving Internet standards.
Network activity is now routine raw material for profiling, advertising, surveillance, and legal demands. VPNs and older privacy proxies still help in some cases, but they centralize trust and are often treated as suspicious outside corporate networks. Guardian Project works on Internet standards so privacy features can become ordinary infrastructure. Our focus is on protocols that divide trust across multiple parties, reduce unnecessary identifying data, and still fit into the tools developers already use.
Newer IETF work moves more privacy into the protocol. A service can receive a request without learning the user’s network address. A server can require proof from a client without asking for a conventional account or exposing more identity than the request needs. But a standard does not help much if the only working code is locked inside closed products. Open source developers then have to guess at behavior after the standardization work is finished. That leads to incompatible implementations, longer launches, and public-interest tools that cannot easily interoperate with commercial deployments.
We try to get involved before a draft becomes an RFC. We take part in working-group discussions, attend IETF meetings, and use hackathons to test ideas against code and other implementations.
That participation includes:
Alongside the ECH work, we are also working on Oblivious HTTP and HTTP Concealed Authentication. These protocols address related but distinct problems: separating the requester from the destination, and proving client authorization without using conventional account or bearer-token patterns.
The immediate audience is application and service developers. Example uses include sensitive form submission, anonymous telemetry, access control, rate limiting, and reducing unauthenticated probing of public services.
More on Oblivious HTTP and Concealed Authentication: implementation details and project links.
Encrypted Client Hello (ECH) is another major part of our standards work. ECH extends TLS so the server name and other early connection metadata can be encrypted during the first stage of an HTTPS connection. Plaintext SNI has long let network observers identify, profile, or block the sites people visit, even when the rest of the connection uses HTTPS.
Through the DEfO project, Guardian Project has worked on ECH implementation and deployment in open source software. That work has included ECH support for OpenSSL and Conscrypt, interoperability testing, and experiments with ECH-enabled clients and servers such as curl, nginx, Apache HTTP Server, lighttpd, HAProxy, and F-Droid-related Android builds.
ECH is separate from Oblivious HTTP and HTTP Concealed Authentication, but the work has the same shape: implement the privacy feature in open source components, test it against other implementations, and write down the deployment problems before they become permanent barriers.