5 ms·

Much of this would be semi-public anyway, they could be analysing HTTPS traffic to find most if not all of these conclusions. Most of it seems to be domain and

Much of this would be semi-public anyway, they could be analysing HTTPS traffic to find most if not all of these conclusions. Most of it seems to be domain and user-agent based. I'd suspect you could even guess the device type based on IP with reasonable accuracy. It wouldn't be entirely correct, but with the kind of scale Cloudflare deal with it doesn't have to be to be useful. The domain (which is public) gives you the info about whether users are browsing or checking out (if a browser hits api.stripe.com, worldpay, PayPal, some checkout API domain for Amazon, etc, then you can infer).

zylepe 8y ago
The particular part that is concerning: If you imagine a typical ecommerce application makes a purchase with a HTTP request like “POST /store/checkout HTTP/1.1” we can look for requests similar to this to understand the activity.
- danpalmer 8y ago
  Yep that is more concerning. They might be using unencrypted HTTP to get an idea of the breakdown and then inferring volumes based on HTTPS traffic and known differences between the two. I basically wouldn't jump to "Cloudflare have a bunch of sensitive data and will use it in bad ways", I suspect they have less data than we might assume from the article, and in general their security/privacy stance is great.
Waterluvian 8y ago
How do you guess the device type based on IP? Do we have any sense how often a mobile device is on wifi? For my brother it's 0%. For me it's 90%.
- danpalmer 8y ago
  I'd guess based on the owner of the IP range. Mobile carriers are an easy case, business ISPs will likely have far fewer mobile devices, residential ISPs will be a mix. I'm sure if anyone has an idea of the breakdowns and averages it would be Cloudfront.
bhauer 8y ago
> Much of this would be semi-public anyway, they could be analysing HTTPS traffic to find most if not all of these conclusions. I'm not sure I understand this sentence. What about analyzing HTTPS traffic is analogous to analyzing "semi-public" data? By design and convention, HTTPS traffic is considered private data. Portions are by technical necessity still public, such as the hostname and IP addresses. In order to produce these findings, private data (which is certainly not public or semi-public) such as full URLs and user-agents needed to be analyzed.

zylepe 8y ago

The particular part that is concerning: If you imagine a typical ecommerce application makes a purchase with a HTTP request like “POST /store/checkout HTTP/1.1” we can look for requests similar to this to understand the activity.

danpalmer 8y ago
Yep that is more concerning. They might be using unencrypted HTTP to get an idea of the breakdown and then inferring volumes based on HTTPS traffic and known differences between the two. I basically wouldn't jump to "Cloudflare have a bunch of sensitive data and will use it in bad ways", I suspect they have less data than we might assume from the article, and in general their security/privacy stance is great.

Waterluvian 8y ago

How do you guess the device type based on IP? Do we have any sense how often a mobile device is on wifi? For my brother it's 0%. For me it's 90%.

danpalmer 8y ago
I'd guess based on the owner of the IP range. Mobile carriers are an easy case, business ISPs will likely have far fewer mobile devices, residential ISPs will be a mix. I'm sure if anyone has an idea of the breakdowns and averages it would be Cloudfront.

bhauer 8y ago

> Much of this would be semi-public anyway, they could be analysing HTTPS traffic to find most if not all of these conclusions. I'm not sure I understand this sentence. What about analyzing HTTPS traffic is analogous to analyzing "semi-public" data? By design and convention, HTTPS traffic is considered private data. Portions are by technical necessity still public, such as the hostname and IP addresses. In order to produce these findings, private data (which is certainly not public or semi-public) such as full URLs and user-agents needed to be analyzed.