9 ms·

I assume this gives the Chinese government raw access to everything before it's TLS-encrypted, right?

by p1mrx 11y ago

Chipperyman 11y ago
It's not like that'd be anything new... The NSA has been known to do this with other major tech companies (google/msft), wouldn't be a stretch to assume they did it at the CDN level. Either way if you have full SSL (not flexible) on cloudflare, cloudflare receives encrypted data from your server anyway, which wouldn't let the gov't see your data. They'd only be able to decrypt Flexible SSL.
cynix 11y ago
Looks like it only supports unencrypted HTTP at the moment.
eastdakota 11y ago
While we extended our network into China, we also took steps to ensure that all customer data would be kept secure. No CloudFlare customer traffic will pass through the China network unless a customer explicitly opts in to the service. Sites' log data from traffic outside of China is never sent into China. And, for customers that opt in to serving content inside China, customer identifiable information such as email addresses, password hashes, and billing information is not sent to the China network nor ever shared with Baidu. Other potentially sensitive information is also kept outside of China. For instance, CloudFlare's Keyless SSL technology allows us to serve encrypted traffic for customers who opt-in to the China network without having to store private SSL keys inside the country. CloudFlare can keep our customers' keys outside of China, if they choose to, while still providing our full suite of services inside China. As part of this partnership, CloudFlare was never asked nor did we ever volunteer to provide any data about any of our users to Chinese, United States, or any other governments’ regulatory authorities. Had that been a requirement of entering the region we would have passed on the opportunity.
- p1mrx 11y ago
  None of the things you said relate to the government having raw access to the plaintext before TLS is applied. Given the parties involved, it seems obvious that this is just a second, more efficient GFW that runs on Baidu's servers instead of at the border.
- chinathrow 11y ago
  Would your statement "nor did we ever volunteer" still be true if you could assume that the infrastructure you're running on (ie. baidu) is rigged to act as a passive interception point?
logn 11y ago
Users connect to Cloudflare edge server with its own certificate. Then it's decrypted and re-encrypted to the origin server. Right? I imagine it's like this: http://i.imgur.com/DASFtbw.png http://i.imgur.com/DASFtbw.png
- nailer 11y ago
  I believe Cloudflare provide their own private CA and let customers set this up to encrypt between Cloudflare and the customer's origin servers. However from speaking to Cloudflare I don't think this is enforced - i.e., Cloudflare allow their customers to indeed send a web users data in the clear over the internet.
  - logn 11y ago
    Even assuming the origin server is HTTPS, the content is decrypted while it's on the edge server. The whole path secured, but it's still MITM'd. That's old news, but now that server is in China, I presume.
    - nailer 11y ago
      Yes, Cloudflare can view the unencrypted content if the customer encrypts, but I think that's less interesting than allowing a customer to choose not to encrypt over the internet.

I assume this gives the Chinese government raw access to everything before it's TLS-encrypted, right?

by p1mrx 11y ago

I assume this gives the Chinese government raw access to everything before it's TLS-encrypted, right?

It's not like that'd be anything new... The NSA has been known to do this with other major tech companies (google/msft), wouldn't be a stretch to assume they did it at the CDN level. Either way if you have full SSL (not flexible) on cloudflare, cloudflare receives encrypted data from your server anyway, which wouldn't let the gov't see your data. They'd only be able to decrypt Flexible SSL.

cynix 11y ago

Looks like it only supports unencrypted HTTP at the moment.

eastdakota 11y ago

While we extended our network into China, we also took steps to ensure that all customer data would be kept secure. No CloudFlare customer traffic will pass through the China network unless a customer explicitly opts in to the service. Sites' log data from traffic outside of China is never sent into China. And, for customers that opt in to serving content inside China, customer identifiable information such as email addresses, password hashes, and billing information is not sent to the China network nor ever shared with Baidu. Other potentially sensitive information is also kept outside of China. For instance, CloudFlare's Keyless SSL technology allows us to serve encrypted traffic for customers who opt-in to the China network without having to store private SSL keys inside the country. CloudFlare can keep our customers' keys outside of China, if they choose to, while still providing our full suite of services inside China. As part of this partnership, CloudFlare was never asked nor did we ever volunteer to provide any data about any of our users to Chinese, United States, or any other governments’ regulatory authorities. Had that been a requirement of entering the region we would have passed on the opportunity.

p1mrx 11y ago
None of the things you said relate to the government having raw access to the plaintext before TLS is applied. Given the parties involved, it seems obvious that this is just a second, more efficient GFW that runs on Baidu's servers instead of at the border.
chinathrow 11y ago
Would your statement "nor did we ever volunteer" still be true if you could assume that the infrastructure you're running on (ie. baidu) is rigged to act as a passive interception point?

logn 11y ago

Users connect to Cloudflare edge server with its own certificate. Then it's decrypted and re-encrypted to the origin server. Right? I imagine it's like this: http://i.imgur.com/DASFtbw.png http://i.imgur.com/DASFtbw.png

nailer 11y ago
I believe Cloudflare provide their own private CA and let customers set this up to encrypt between Cloudflare and the customer's origin servers. However from speaking to Cloudflare I don't think this is enforced - i.e., Cloudflare allow their customers to indeed send a web users data in the clear over the internet.
- logn 11y ago
  Even assuming the origin server is HTTPS, the content is decrypted while it's on the edge server. The whole path secured, but it's still MITM'd. That's old news, but now that server is in China, I presume.
  - nailer 11y ago
    Yes, Cloudflare can view the unencrypted content if the customer encrypts, but I think that's less interesting than allowing a customer to choose not to encrypt over the internet.