4 ms·
Surprised Troy is so pro-cloudflare. I feel like they create a lot of security headaches.
by sleepychu 9y ago
Surprised Troy is so pro-cloudflare. I feel like they create a lot of security headaches.
- JosephRedfern 9y agoCan you elaborate on that?
- tempay 9y agoOP is probably referring to [1] or the general fact that they MITM most traffic that uses their services. [1] https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/ https://blog.cloudflare.com/incident-report-on-memory-leak-c...
- dingo_bat 9y agoTbf that's the actual service they offer. It's not like they are being sneaky.
- tialaramex 9y agoTo be sure, but anybody using CloudFlare needs to keep in the back of their head that everything going through CF is not only accessible to a hypothetical Bad Guy at CloudFlare it can also (and remember has, this is a real bug that happened) get exposed to unrelated parties on the Internet if CF mixes your data with somebody else's by mistake. This makes CF seem fine for your different variants of popcorn.gif, your (subresource integrity checked) Javascript implementation of the VIC-20 computer, or a public blog post, and NOT so great for patient access to histology results, private web forums, banking, and many other things on the Web.
- matthewmacleod 9y agoOf course they do that. How else would such a service possibly operate?
- vader1 9y agoBy offering two different models and letting you choose between them for each hostname under Cloudflare. 1) Injecting themselves on the application layer (the current model) 2) Injecting themselves on the network layer, passing through only encrypted traffic between the client and your servers Not every feature they currently offer would still be possible in model #2, but most of them (including DDOS protection) can still work in a limited fashion.
- tomalpha 9y agoTroy is clearly very pro Cloudflare and Azure. I’m only familiar with them at a high level and it would be great to hear counterpoints to his praise and get (at least the impression of) a debate that encompasses their pros and cons. +1 for being interested in expanding this
- StavrosK 9y agoBasically they add yet another layer of centralization and they're a MITM for all your traffic, so they're an easy target for surveillance. If only they weren't so convenient... I use their DNS service because it's top notch, but I also tend to enable their MITM service because their CDN nodes are super fast and require just a single toggle to enable. They read my far-future expires headers and just cache the content on the edge, no extra work needed.
- Daycrawler 9y agoDoesn't know about Cloudflare but as a Microsoft Regional Director he's certainly pro Azure.
- copper_think 9y agoSuch a weird title; it makes me think he works for them, but he doesn't
- ptman 9y agodidn't he work for microsoft previously?
- sghi 9y agoNo, he worked for Pfizer - https://www.troyhunt.com/today-marks-two-important-milestones/ https://www.troyhunt.com/today-marks-two-important-milestone...
- jwilk 9y agohttps://www.troyhunt.com/microsoft-regional-director/ https://www.troyhunt.com/microsoft-regional-director/
- Cthulhu_ 9y agoIn this case though, security concerns do not apply; the source data is secure, the website does not use authentication, and HTTPS adds an extra layer of security on any input (which is hashed and cropped clientside)
- moviuro 9y ago> on any input (which is hashed and cropped clientside) You could still run a volume analysis on the reply. If it's very short, you can guess it's a 404. If it isn't, you might be able to get which prefix was queried... \end{tin foil hat}
- jgrahamc 9y agoThat won't work since all possible 5 character prefixes return data.
- moviuro 9y agoThey don't all return the same amount though. According to my Chrome here and now: > https://api.pwnedpasswords.com/range/aaaaa https://api.pwnedpasswords.com/range/aaaaa = 28.8KB > https://api.pwnedpasswords.com/range/01234 https://api.pwnedpasswords.com/range/01234 = 28.5KB > https://api.pwnedpasswords.com/range/af0fa https://api.pwnedpasswords.com/range/af0fa = 23.2KB
- dx034 9y agoHe says that he supports CF because they enable SSL on so many websites that wouldn't have it otherwise. I guess the fact that he gets a lot of their premium features for free helps as well.
- RKearney 9y agoThe fact that CloudFlare has "Flexible SSL" leads me to believe they don't care about security at all. I've asked them to at least post a "CF-SSL: Flexible" header or similar to responses so someone could develop a Chrome extension to alert on this behavior. They're presenting sites over HTTPS to visitors while tunneling the full request in plain text over HTTP across the internet back to the origin server. Because of this, web browsers like Chrome will allow access to sensitive APIs like Geolocation despite the end to end communication being insecure. If I could, I'd personally blacklist all "Flexible SSL" sites from my daily browsing.
- sleepychu 9y agoJust revoke CF's certificate on your local machine. If they won't tell you when they're being flexible you have to assume they're always being flexible.
- dx034 9y agoThat has undesired effects. I have a page that uses SSL CF<->server via their certificate. The certificate for the end user is still a CF certificate. The end user has no way of finding out if the connection to origin is encrypted.
- r1ch 9y agoAgreed. It's getting a bit much, almost every one of his blog posts has some advertisement for Cloudflare. 2 of Cloudflare's 3 SSL options generate an insecure setup yet look perfectly fine to the user with a shiny green padlock in the address bar. That really isn't acceptable.