5 ms·

Well, thanks, but as I thought, its not that easy. First one is by CF themselves, no source :) Second is not used and not working. And nothing for Safari.

qmarchi 8y ago
So some thing you can look for in a request: * `server: cloudflare` - Although CloudFlare uses a nginx, they report themselves properly in the server header * `Cookie: _cfudid:*` - CloudFlare uses the cookie header to identify users and prevent abuse. If you delete this cookie too many times, your IP is flagged by CloudFlare and you may receive an interstitial blocking you from accessing a site. * IP Ranges: https://www.cloudflare.com/ips-v4 and https://www.cloudflare.com/ips-v6 - CloudFlare owns the routing to these IP addresses. If you want, setup some Firewall Rules to block access to these ranges. All in all, CloudFlare is probably the least of your worries. You might want to do some investigation on your ISP, some of which MITM and track any insecure content.
- deleted 8y ago
  [deleted]
- horsawlarway 8y ago
  No joke. CloudFlare is near the bottom of my list of worries. I'm most concerned about my bank. They know goddamn everything about my spending history, and it's a complete treasure trove of data because it actually shows where I spend money. I'm second most concerned about my ISP. They see every outgoing connection I make, and have no trouble tying it all back to me. Cloudflare is... just not that big a deal. Are you concerned about Microsoft being able to MITM every connection to a site hosted on Azure? Amazon being able to MITM every connection made to AWS? Google being able to MITM every connection made to GCE? "Yes" is a fair answer, but it means you're using a minuscule fraction of the available internet. Otherwise I don't really see the need to pick on Cloudflare. They're doing exactly what the company that's using them asked them to do (and getting paid for it too...)
  - auslander 8y ago
    > doing exactly what the company that's using them asked them to do But how do I, website user, can know it? Given how many sites are served by CF, my private, decrypted, data can be aggregated and I would have no clue. For ISPs use VPN. And I doubt (seriously) AWS (Azure) has means to do MITM, reading private keys from virtual machines? cmon. Banking is a real bitch, agree :)
    - detaro 8y ago
      How many people using AWS, GCP or Azure are terminating TLS on their instances, instead of on the offered load-balancing services? How many services run (partially) not in VMs, but on PaaS (e.g. App Engine), load data directly from storage services (e.g. Firebase or S3), ...
    - Operyl 8y ago
      We've told you several times how to know it as a user. You just conveniently are skipping over it..
      - auslander 8y ago
        You posted link to source for Claire after making this comment. I said thanks above.
    - samb1729 8y ago
      Personally I trust that GDPR and its potentially enormous fines provide sufficient economic incentive for these big cloud companies to do the right thing. That is to say I now believe that not only are Google, Cloudflare, Amazon not proactively sniffing traffic, but also that they'll have invested a massive amount of money making sure it's really hard to do undetected. Of course I also fully expect that any one of them would give me up to law enforcement iff compelled by a court.
    - gruez 8y ago
      >And I doubt (seriously) AWS (Azure) has means to do MITM, reading private keys from virtual machines? cmon. that's only if the website(s) are only using their IaaS offerings (which I doubt because they're crazy expensive compared to DO or vultr) and not their PaaS offerings. With PaaS (think heroku), they terminate the SSL and control the software for the http server, not you.
- kawsper 8y ago
  > You might want to do some investigation on your ISP Doesn't most ISPs have to live up to certain laws about protecting the customers? I think those regulations are much more strict than what is required of CloudFlare.
Operyl 8y ago
Incorrect, the source is freely available, :). https://github.com/cloudflare/claire https://github.com/cloudflare/claire
- auslander 8y ago
  well done, my bad :)
  - deleted 8y ago
    [deleted]
- deleted 8y ago
  [deleted]

qmarchi 8y ago

So some thing you can look for in a request: * `server: cloudflare` - Although CloudFlare uses a nginx, they report themselves properly in the server header * `Cookie: _cfudid:*` - CloudFlare uses the cookie header to identify users and prevent abuse. If you delete this cookie too many times, your IP is flagged by CloudFlare and you may receive an interstitial blocking you from accessing a site. * IP Ranges: https://www.cloudflare.com/ips-v4 and https://www.cloudflare.com/ips-v6 - CloudFlare owns the routing to these IP addresses. If you want, setup some Firewall Rules to block access to these ranges. All in all, CloudFlare is probably the least of your worries. You might want to do some investigation on your ISP, some of which MITM and track any insecure content.

deleted 8y ago
[deleted]
horsawlarway 8y ago
No joke. CloudFlare is near the bottom of my list of worries. I'm most concerned about my bank. They know goddamn everything about my spending history, and it's a complete treasure trove of data because it actually shows where I spend money. I'm second most concerned about my ISP. They see every outgoing connection I make, and have no trouble tying it all back to me. Cloudflare is... just not that big a deal. Are you concerned about Microsoft being able to MITM every connection to a site hosted on Azure? Amazon being able to MITM every connection made to AWS? Google being able to MITM every connection made to GCE? "Yes" is a fair answer, but it means you're using a minuscule fraction of the available internet. Otherwise I don't really see the need to pick on Cloudflare. They're doing exactly what the company that's using them asked them to do (and getting paid for it too...)
- auslander 8y ago
  > doing exactly what the company that's using them asked them to do But how do I, website user, can know it? Given how many sites are served by CF, my private, decrypted, data can be aggregated and I would have no clue. For ISPs use VPN. And I doubt (seriously) AWS (Azure) has means to do MITM, reading private keys from virtual machines? cmon. Banking is a real bitch, agree :)
  - detaro 8y ago
    How many people using AWS, GCP or Azure are terminating TLS on their instances, instead of on the offered load-balancing services? How many services run (partially) not in VMs, but on PaaS (e.g. App Engine), load data directly from storage services (e.g. Firebase or S3), ...
  - Operyl 8y ago
    We've told you several times how to know it as a user. You just conveniently are skipping over it..
    - auslander 8y ago
      You posted link to source for Claire after making this comment. I said thanks above.
  - samb1729 8y ago
    Personally I trust that GDPR and its potentially enormous fines provide sufficient economic incentive for these big cloud companies to do the right thing. That is to say I now believe that not only are Google, Cloudflare, Amazon not proactively sniffing traffic, but also that they'll have invested a massive amount of money making sure it's really hard to do undetected. Of course I also fully expect that any one of them would give me up to law enforcement iff compelled by a court.
  - gruez 8y ago
    >And I doubt (seriously) AWS (Azure) has means to do MITM, reading private keys from virtual machines? cmon. that's only if the website(s) are only using their IaaS offerings (which I doubt because they're crazy expensive compared to DO or vultr) and not their PaaS offerings. With PaaS (think heroku), they terminate the SSL and control the software for the http server, not you.
kawsper 8y ago
> You might want to do some investigation on your ISP Doesn't most ISPs have to live up to certain laws about protecting the customers? I think those regulations are much more strict than what is required of CloudFlare.

Operyl 8y ago

Incorrect, the source is freely available, :). https://github.com/cloudflare/claire https://github.com/cloudflare/claire

auslander 8y ago
well done, my bad :)
- deleted 8y ago
  [deleted]
deleted 8y ago
[deleted]