4 ms·

If they’re stripping encryption and reapplying they’re MITM. Seems pretty straightforward.

by deno 10y ago

rakoo 10y ago
It's amazing how you can redeclare the meaning of words and distort reality just to fit your narrative. Stripping encryption implies that there was, at some point, some sort of encryption between the browser and the website itself, which there never ever was. In the Cloudflare architecture the browser never ever interacts with the website, always with the Cloudflare servers. When you've got the small lock, it never implied that you were connecting to the website, but always that you were connecting to what lies behind the domain name, which is the Cloudflare servers. As an additional point, the website owner has always agreed to use this architecture; they're not somehow victim of some kind of attack from a spooky middleman. They ask (heck, some of them even pay) for it. It is part of the way they want to serve content. You should tone down the sentimental analysis and keep to the facts. Cloudflare is a reverse proxy service the website owner uses; it is part of their infrastructure.
- CPLX 10y ago
  > In the Cloudflare architecture the browser never ever interacts with the website, always with the Cloudflare servers. Indeed. It's almost as if metaphorically speaking they were standing there between them... like a man... in the middle...
- deno 10y ago
  The name on the certificate is not Cloudflare’s. It’s origin’s. There’s no legitimate mechanism for reverse proxies to operate HTTPs sites, other than to act as a dumb pipe. Calling it MITM is therefore entirely appropriate. Whether this protocol abuse is sanctioned by origin or not is entirely beside the point.
snowwrestler 10y ago
Simply decrypting and re-encrypting web traffic in an intentional and authorized way is not MITM and should not called that. So, why do people call CloudFlare MITM? 1) They honestly don't know that MITM is just the name for an attack, not a neutral term. 2) They think any mid-route decryption/re-encryption is bad and dangerous. 3) They are mad about some aspect of CloudFlare's service, and call it MITM to make it sound worse to everyone else. Folks in the 1 and 2 camp just need to get educated. Folks in the 3 camp might have good points on the substance, but they are contributing to the misunderstandings of 1 and 2.
- deno 10y ago
  Assumption: End-to-end encryption to the name on the certificate. Reality: Someone else (Cloudflare) claims to be the name on the certificate, whereas in reality they’re not. That’s the textbook definition of MITM attack, whether you like it or not. Of course all CDNs work like that. No one’s claiming otherwise. Cloudflare is just bringing all the ways internet is fundamentally broken to the forefront. Their unapologetic and extensive abuse of those design flaws (captcha pages) are a constant reminder of just how a hopeless mess the internet is.
  - snowwrestler 10y ago
    And where is the website hosted? If you're on AWS, guess what, Amazon is decrypting the traffic, not the website owner. Calling Cloudflare MITM but not Amazon is just demonstrating that you haven't thought carefully about how professional service providers work together to deliver a website. The certificate authenticates that you are seeing the website that the website owner intended you to see. If the website owner hires Cloudflare as a professional service provider, that premise is not violated!
    - deno 10y ago
      The difference is Cloudflare is perfectly content to forward the backbone traffic unencrypted over public internet. In fact, they advertise this malfeature. Anyway as I stated before the bar for calling it MITM is simply the intended behaviour of the protocol (HTTPS). Which is very much violated. Whatever negative or otherwise connotations the term has doesn’t change the fact that it is technically correct. Really all I’m arguing here. There’s plenty of better reasons to hate Cloudflare anyway.
      - snowwrestler 10y ago
        > The difference is Cloudflare is perfectly content to forward the backbone traffic unencrypted over public internet. In fact, they advertise this malfeature. This puts you into segment #3 in my list above. And I agree with you: the CloudFlare "flexible" SSL that sends last-leg traffic in the clear over the open Internet is a terrible idea. But while that terrible idea opens up the potential for MITM attacks, it is not, itself, a MITM because the website owner has authorized CloudFlare to do that. And of course there are levels of CloudFlare service that do properly re-encrypt the last leg to the origin. > Anyway as I stated before the bar for calling it MITM is simply the intended behaviour of the protocol (HTTPS). Which is very much violated. Whatever negative or otherwise connotations the term has doesn’t change the fact that it is technically correct. Really all I’m arguing here. You need to understand that you are not correct on the technicality. None of the protocols used in HTTPS are violated by decrypting or encrypting a session using the proper keys, even if it happens several times along the way. Not every bad idea is a technical protocol violation. Not every bad idea is equivalent to an attack. Abusing the term "MITM" makes it harder to talk with specificity about actual MITM risks. If CloudFlare itself is always a "MITM", then how do we explain why their Flexible SSL service is riskier than their Full/Strict SSL service? The former makes it easier for some mid-point to impersonate or alter the origin website. But now what do we call that? An "actual" MITM? A "real" MITM? Let's just leave MITM to mean an attack. It's a lot clearer that way.

If they’re stripping encryption and reapplying they’re MITM. Seems pretty straightforward.

by deno 10y ago

If they’re stripping encryption and reapplying they’re MITM. Seems pretty straightforward.

rakoo 10y ago

It's amazing how you can redeclare the meaning of words and distort reality just to fit your narrative. Stripping encryption implies that there was, at some point, some sort of encryption between the browser and the website itself, which there never ever was. In the Cloudflare architecture the browser never ever interacts with the website, always with the Cloudflare servers. When you've got the small lock, it never implied that you were connecting to the website, but always that you were connecting to what lies behind the domain name, which is the Cloudflare servers. As an additional point, the website owner has always agreed to use this architecture; they're not somehow victim of some kind of attack from a spooky middleman. They ask (heck, some of them even pay) for it. It is part of the way they want to serve content. You should tone down the sentimental analysis and keep to the facts. Cloudflare is a reverse proxy service the website owner uses; it is part of their infrastructure.

CPLX 10y ago
> In the Cloudflare architecture the browser never ever interacts with the website, always with the Cloudflare servers. Indeed. It's almost as if metaphorically speaking they were standing there between them... like a man... in the middle...
deno 10y ago
The name on the certificate is not Cloudflare’s. It’s origin’s. There’s no legitimate mechanism for reverse proxies to operate HTTPs sites, other than to act as a dumb pipe. Calling it MITM is therefore entirely appropriate. Whether this protocol abuse is sanctioned by origin or not is entirely beside the point.

snowwrestler 10y ago

Simply decrypting and re-encrypting web traffic in an intentional and authorized way is not MITM and should not called that. So, why do people call CloudFlare MITM? 1) They honestly don't know that MITM is just the name for an attack, not a neutral term. 2) They think any mid-route decryption/re-encryption is bad and dangerous. 3) They are mad about some aspect of CloudFlare's service, and call it MITM to make it sound worse to everyone else. Folks in the 1 and 2 camp just need to get educated. Folks in the 3 camp might have good points on the substance, but they are contributing to the misunderstandings of 1 and 2.

deno 10y ago
Assumption: End-to-end encryption to the name on the certificate. Reality: Someone else (Cloudflare) claims to be the name on the certificate, whereas in reality they’re not. That’s the textbook definition of MITM attack, whether you like it or not. Of course all CDNs work like that. No one’s claiming otherwise. Cloudflare is just bringing all the ways internet is fundamentally broken to the forefront. Their unapologetic and extensive abuse of those design flaws (captcha pages) are a constant reminder of just how a hopeless mess the internet is.
- snowwrestler 10y ago
  And where is the website hosted? If you're on AWS, guess what, Amazon is decrypting the traffic, not the website owner. Calling Cloudflare MITM but not Amazon is just demonstrating that you haven't thought carefully about how professional service providers work together to deliver a website. The certificate authenticates that you are seeing the website that the website owner intended you to see. If the website owner hires Cloudflare as a professional service provider, that premise is not violated!
  - deno 10y ago
    The difference is Cloudflare is perfectly content to forward the backbone traffic unencrypted over public internet. In fact, they advertise this malfeature. Anyway as I stated before the bar for calling it MITM is simply the intended behaviour of the protocol (HTTPS). Which is very much violated. Whatever negative or otherwise connotations the term has doesn’t change the fact that it is technically correct. Really all I’m arguing here. There’s plenty of better reasons to hate Cloudflare anyway.
    - snowwrestler 10y ago
      > The difference is Cloudflare is perfectly content to forward the backbone traffic unencrypted over public internet. In fact, they advertise this malfeature. This puts you into segment #3 in my list above. And I agree with you: the CloudFlare "flexible" SSL that sends last-leg traffic in the clear over the open Internet is a terrible idea. But while that terrible idea opens up the potential for MITM attacks, it is not, itself, a MITM because the website owner has authorized CloudFlare to do that. And of course there are levels of CloudFlare service that do properly re-encrypt the last leg to the origin. > Anyway as I stated before the bar for calling it MITM is simply the intended behaviour of the protocol (HTTPS). Which is very much violated. Whatever negative or otherwise connotations the term has doesn’t change the fact that it is technically correct. Really all I’m arguing here. You need to understand that you are not correct on the technicality. None of the protocols used in HTTPS are violated by decrypting or encrypting a session using the proper keys, even if it happens several times along the way. Not every bad idea is a technical protocol violation. Not every bad idea is equivalent to an attack. Abusing the term "MITM" makes it harder to talk with specificity about actual MITM risks. If CloudFlare itself is always a "MITM", then how do we explain why their Flexible SSL service is riskier than their Full/Strict SSL service? The former makes it easier for some mid-point to impersonate or alter the origin website. But now what do we call that? An "actual" MITM? A "real" MITM? Let's just leave MITM to mean an attack. It's a lot clearer that way.