33 ms·

Warp – Mobile VPN

• ilarum 8y ago
  It would be really interesting to learn more about the technical details of the "UDP-based protocol" Warp uses
  • deleted 8y ago
    [deleted]
  • jgrahamc 8y ago
    I imagine at some point we'll blog about it, but we've been working with the Neumob technology we acquired and QUIC for some time. Also, this post is relevant: https://blog.cloudflare.com/boringtun-userspace-wireguard-rust/ https://blog.cloudflare.com/boringtun-userspace-wireguard-ru...
    • foobarbazetc 8y ago
      How does that work with wireguard though? The Neuomob thing was pitched at us as some black box “magic” you integrate into your own app which we turned down since the library source isn’t available. Is it running on the mobile VPN app or is it running between the VPN server and whatever the exit POP is?
  • zackbloom 8y ago
    It's WireGuard [1] coupled with tech from our Mobile SDK [2] and (in the case of Warp+) Argo [3] 1- https://github.com/cloudflare/boringtun https://github.com/cloudflare/boringtun 2- https://blog.cloudflare.com/mobile-sdk-acceleration/ https://blog.cloudflare.com/mobile-sdk-acceleration/ 3- https://www.cloudflare.com/products/argo-smart-routing/ https://www.cloudflare.com/products/argo-smart-routing/
    • acdha 8y ago
      Are you also bosdev? I noticed an identical comment posted under that account before this one.
      • zackbloom 8y ago
        I was, at one point in my life, a Boston Developer ;). Sadly at least one of those things is no longer accurate. Switched the account so it wouldn't be confusing who was commenting.
        • acdha 8y ago
          That makes sense — I had seen it on my phone under that name and was then surprised when I pulled the link up to share it, although since I'm at 160,606 on the wait-list that hurry was probably unnecessary ;-)
    • vbezhenar 8y ago
      Is there significant differences from stock wireguard? Can I benefit from your work on my own server? Also I wonder how do you work with censors? For example Russia censors internet and requires that all VPN services cooperate and censor internet for Russian customers as well (probably they will ban services that won't comply). Will you cooperate or will you accept that Russian users won't be able to reach your service? I guess, that some other countries use or will use similar techniques. For example I'm from Kazakhstan, there are many banned websites and they seem to ban popular VPN and proxy services as well (I'm using my own server with OpenVPN, but obviously I'm just a small fish to bother).
      • tracker1 8y ago
        The benefits to Cloudflare is they will have more entry/exit nodes on their network(s). While running your own will go through your own server in/out and even then when travelling may only add more latency. Many on here are and have been doing just that all the same.
    • hsivonen 8y ago
      Can the service be used with another Wireguard client (hopefully bundled into Linux distros in the future) without installing Cloudflare’s client software?
      • jgrahamc 8y ago
        We do not currently plan to allow third-party WireGuard clients to connect to the service.
        • sascha_sl 8y ago
          It it just me or does it sound wrong to call wireguard, the kernel module, third party software in this context? That's literally the reference implementation.
          • arghwhat 8y ago
            It is wrong. Warp is the third-party implementation. It would be amazing if it could be made to work from standard wireguard, but I suppose there's a chance that if desktop versions arrive, you'll be able to extract the keys. The only thing stopping that would be if Cloudflare broke the protocol.
            • jgrahamc 8y ago
              We can argue about the terminology but from the perspective of the company other WireGuard clients (including the official ones) are 'third-party' in the sense that we don't control them. That makes supporting users of those clients more expensive for us (e.g. we currently have a mobile app for Warp, someone calls our support asking for help with a Linux client...)
              • nickysielicki 8y ago
                Not supporting a configuration is much different than actively prohibiting it. It's okay to just say, "Hey, we are running a free VPN. We're making some privacy guarantees and are trying to log as little as possible. That exposes us to being abused, which means that we have to put some limits in-place on the client." There's nothing unreasonable about that at all.
  • ignoramous 8y ago
    It seems to me like cloudflare might be doing some, none, or all of these: 1. VPN from mobile device to the nearest Cloudflare PoP. 2. Use Cloudflare backbone to connect to the nearest exit PoP to destination. 3. Between entry and exit PoPs, do all sorts of optimisations that are possible, like: 3a. Jumbo frames, custom/advanced form of TCP congestion control, multipath, fast-open. 3b. Custom transport protocol (quic, sctp, etc). 3c. Custom compression and error correction schemes. 4. Reverse CDN: Proxy HTTP/S requests and serve content from cache. 5. Peer CDN: serve content from nearby devices? Something like AWS Silk [0] or Google Chrome FlyWheel [1] but on steroids. Easier said than done, I guess. [0] https://news.ycombinator.com/item?id=3215778 https://news.ycombinator.com/item?id=3215778 [1] https://news.ycombinator.com/item?id=9441372 https://news.ycombinator.com/item?id=9441372
• dispat0r 8y ago
  Support for Linux would be nice.
  • onychomys 8y ago
    Are there any linux phones? I thought everybody was either on OS or some flavor of Android (....plus some WindowsPhone holdouts, I suppose). Android is vaguely based on the linux kernal, but nobody would really count that.
    • newaccoutnas 8y ago
      A wireguard (proper) android client has been on my phone for months. Cloudflare seemed to have talked very little to the upstream at all here. Jason commented on this here: https://lists.zx2c4.com/pipermail/wireguard/2019-March/004048.html https://lists.zx2c4.com/pipermail/wireguard/2019-March/00404... It'd be interesting to see a response from Cloudflare (unless there is one an I've missed it)
      • jgrahamc 8y ago
        See https://news.ycombinator.com/item?id=19544819 https://news.ycombinator.com/item?id=19544819
    • TheCraiggers 8y ago
      > Are there any linux phones? Well, there's at least two coming out this year. I can understand them wanting to handle the 99% of use cases first, but as I understand it they won't allow normal Wiregaurd clients to connect which is sad but entirely their call.
• tyingq 8y ago
  Is there any notable potential for people to use this for abuse? You guys tend to put up captchas for inbound Tor traffic, I assume for similar reasons.
  • jgrahamc 8y ago
    Tor is different. We don't put up CAPTCHAs by default for Tor. We totally changed how we handle Tor years ago. But, because Tor provides anonymity, there is _a lot_ of abuse through it. A lot.
    • tyingq 8y ago
      I read the privacy sections in your blog post, and it feels like WARP offers anonymity, maybe not from CF, but perhaps from everyone else.
      • jerf 8y ago
        Tone note: I'm posting technically, not value-judging. I would say "anonymity" is a fairly strong term for what's being offered here. It's going to hide your source IP, and if you don't mind CF seeing your unencrypted content (and the fact it's unencrypted kinda means that from a technical perspective, you already don't care), it may improve the amount of the connection to unencrypted content that is encrypted (and thereby block the "coffee shop" attack fairly well), but that's all. They're not going to actively strip the bajillions of other active tracking techniques being used nowadays. Your phone will still track location. Facebook will still track you on your phone every bit as much as they did before. etc. This is part of a complicated set of measures you may be able to take to attain anonymity, but not even remotely the full package. Again, this is a technical posting to ensure that people understand what this is and is not. This is not a criticism of the service for not being something it isn't or anything like that. Less technically and more value-judgy (though still not much), note the title: "Introducing Warp: Fixing Mobile Internet Performance and Security" Performance was highlighted first, security second. This seems to me to be a reasonable and accurate reflection of the nature of the service.
      • 8y ago
• PopeDotNinja 8y ago
  I wonder how well this works when using using wifi on and accessing a corporate intranet. I discovered https://myhrportal https://myhrportal didn't work when I pinned my DNS to 8.8.8.8.
  • TheCraiggers 8y ago
    What made you think your corporate HR portal's DNS entry would be global? You're going to at least need a TLD there, buddy.
    • PopeDotNinja 8y ago
      I didn't think it would work. From my own experiences... One day when away from the office, I pinned my wifi DNS settings to 8.8.8.8 just to try it out & compare it to the DNS I normally use at home, but then I forgot to undo it. When I got back to the office, the office Intranet was unsurprisingly inaccessible, and I removed the pinned DNS settings. I knew how to solve the problem, but less savvy folks trying out the Cloudflare product might not, which could create some confusion for IT helpdesks. Cloudflare is concerned with the user experience of people who don't know what a VPN is, and that's why I mentioned it. Normally I would have just tried it & reported the edge case I it exists, but the app isn't usable yet, so I posed the question instead. Judging by the downvotes, I should have mentioned that in my comment above :)
• ChrisSD 8y ago
  Last time I used 1.1.1.1 DNS I sometimes had problems when visiting bbc.co.uk. It seemed to be trying to look up the domain on cloudflare's service for some reason. Was I the only one to have this problem? Would it be fixed now?
  • aroch 8y ago
    1.1.1.1 doesn't use eDNS and likely never will: https://developers.cloudflare.com/1.1.1.1/nitty-gritty-details/ https://developers.cloudflare.com/1.1.1.1/nitty-gritty-detai... So geo-specific things will break... BBC.com should load though since its for out-of-UK people
    • nnx 8y ago
      Not ideal for performance too, sites/APIs with regional endpoints could then be slower. Understand the privacy impact, could CloudFlare client “anonymize” edns subnet by region-ing the request based on large cloud regions? (rather than actual client subnet)
    • kentonv 8y ago
      Site should load just fine without eDNS -- even "geo-specific" ones. They will just route you as if you came from your local Cloudflare PoP rather than your home IP; usually not a big difference since Cloudflare is in so many locations. I'm not having any trouble with bbc.co.uk on 1.1.1.1, maybe it was a temporary hiccup. (Disclosure: I work for Cloudflare but not on this product.)
      • miyuru 8y ago
        > not a big difference I am getting more than 300ms difference to google.com https://pastebin.com/raw/QnbWXU1a https://pastebin.com/raw/QnbWXU1a
        • kentonv 8y ago
          Ouch. Do you know which PoP (point of presence) you're hitting? To find out, Look at the last three letters in the CF-Ray header on any response from a Cloudflare site, e.g. curl -v cloudflare.com 2>&1 | grep -i CF-Ray The letters should correspond to an airport code nearby the CF server you landed on. Let me know what it says.
• seanwilson 8y ago
  Is there a better summary of what's being offered here?
  • zackbloom 8y ago
    You could try looking at https://1.1.1.1 https://1.1.1.1, it is more brief and to the point, but you might be looking for something more technical and direct?
  • ilarum 8y ago
    Cloudflare already has an app on mobile devices - but so far it only served your DNS queries. Now the app behaves as a VPN for all your mobile traffic - all data is routed within Cloudflare's network from the moment it leaves your device, which is faster than going through the public internet.
    • mercora 8y ago
      I think it is important to notice that the traffic is first routed to Cloudflare over the public internet, so technically it is not the moment it leaves your device when it starts to get routed inside CloudFlares network and the public internet again soon after in most cases. Being faster crucially relies on having nearby access to their network from your device and from their network to the destination. Otherwise you ultimately just add some additional hops in between, making it likely to be slower in terms of latency instead. I also would not expect much of a difference performance wise if you access services already using CloudFlare as the endpoints network is likely the same there. However, this is only relevant for your argument of it supposedly being faster. Of course the packets leaving your device are encapsulated and unreadable to third party observers. After being decapsulated its not about routing your VPN traffic anymore but the packets inside which is probably what you were referring to on its own.
• larrysalibra 8y ago
  Warp+ with Argo sounds like it has the potential to really improve the internet experience on ISPs that have poor routes. Will warp be available on desktop machines at some point?
  • sudhirj 8y ago
    Yes, the article mentions that desktop apps are coming soon.
  • zackbloom 8y ago
    Yes! We're working on desktop clients as well but they'll be available a bit later than the mobile launches, as the most performance benefit is available when you're on a cell network.
• jerf 8y ago
  I've downloaded 1.1.1.1 fresh from Google Play just now, but I don't see any "get in line" option. Buried somewhere, or Google still staggering out the latest version of the app?
  • jgrahamc 8y ago
    It's coming. We have released but there's some latency in the various app stores around the world.
    • jerf 8y ago
      Got it now. Thank you.
  • wyldfire 8y ago
    I did the same and it was at the top of the screen with the big button to enable DNS. It was not labeled "Warp" or "VPN" (in keeping with the "A VPN for People Who Don’t Know What V.P.N. Stands For" theme I suppose).
• sudhirj 8y ago
  TLDR Cloudflare released a privacy focused DNS resolver at 1.1.1.1, then an app for iOS and Android that set up VPN profiles to use those DNS revolvers. Now the apps will be upgraded with Warp, an option to set up a full data VPN over WireGuard, terminating at any worldwide PoP. This should give you super low latency to your VPN server, and also open up the possibility of local caching smarts on the device. Basic service is free, premium service coming that’ll put you on the CF backbone for all your traffic, should take you off the public internet and speed things up. Desktop versions coming as well.
• gpm 8y ago
  I currently use DNS66 for ad blocking on android without root. Is there a way to do something similar while using this app? Alternatively, I have a Xperia XA1 running a June 5, 2017 security patch. It's been my intent for a long time now to figure out how to get root without unlocking the boot loader the sony approved way (which makes the camera less functional). Anyone have any pointers on easy to exploit privilege escalations that should exist on my phone?
  • Abishek_Muthian 8y ago
    You are worried about unlocking bootloader (which you should) for rooting or system less mod, but okay for an exploit operating from user space?
    • gpm 8y ago
      Yes, basically. Could also approach from usb/wifi/bluetooth/etc instead of local userspace. The problem specifically is that unlocking the bootloader the official way deletes drm keys stored in a "TA" partition, and that makes the camera less functional. It would be sufficient to find a vulnerability that let me back up the DRM keys - but that seems unlikely without gaining root access and I'd have more confidence that I backed up the right thing with root access.
      • Abishek_Muthian 8y ago
        Okay that makes more sense. Unfortunately AFAIK all community run mods for Android require bootloader to be unlocked.
  • tracker1 8y ago
    Despite criticisms, I've been using the Brave browser on Android, which is pretty much Chrome with integrated AdBlock plus. Though there is some level of irksome override with some advertisers, it's been about the best overall experience for me. May actually switch my desktop browser at home when I build my new computer.
• kennyadam 8y ago
  So, I'm apparently #161486 on the wait list. Not holding my breath... Sounds interesting though!
  • netsharc 8y ago
    It's not like it's a line at the DMV... I'd imagine they'd test the performance with say 100 users, then another 900 to make it a round 1000, then if they see the 1000 users only use 1% CPU, they could just go up to 10000 to see if it uses 10% CPU or just 5%... And after they figure out how many servers/how much bandwidth they need, they could just bring in e.g. 100K users online at once.
    • gpm 8y ago
      They also probably want to roll out in batches to reduce the impact of bugs, not just to measure resource usage. But absolutely agree that once they get comfortable bringing in 100k at once is perfectly possible.
  • fancy44 8y ago
    I'm trying to join the wait list but it just kicks me back to the join wait list button page after a quick second of spinning wheel. Just does it over and over.
    • jgrahamc 8y ago
      We are working to fix that. Sorry you are having trouble.
      • fancy44 8y ago
        It worked now. Thanks!!
    • felipemesquita 8y ago
      Getting the same thing here
  • 8y ago
• deleted 8y ago
  [deleted]
• tomschlick 8y ago
  Anyone else get a spinner when clicking "Join the waitlist" and the button to join just reappears again? (iPhone XS, running latest update)
  • zackbloom 8y ago
    Sorry about that, there's an issue we're currently dealing with which hits people who had a specific version of the old 1.1.1.1 app and just updated. It should be fixed shortly.
    • tomschlick 8y ago
      Thanks. Just tried again and got on the list!
  • jgrahamc 8y ago
    Just so you know you are not alone... I'm Cloudflare's CTO and that happens to me. We are working on it :-) Edit: It's fixed and I'm on the waitlist.
  • newscracker 8y ago
    Update: It got sorted out for me and I got my waitlist number after trying again. Now the top banner just shows me my waitlist number. Happened to me as well, and that’s why I came looking for the canonical post on this topic to see what’s happening. I switched networks and tried, but got no waitlist number. There’s just a message saying I’m on the waitlist and the button to join the waitlist is still visible and enabled. Now that I see people from Cloudflare have responded, I’ll just wait and see.
• NetBeck 8y ago
  APNIC acquires DNS data in exchange for 1.1.1.1 [1], are they also involved with the VPN service? [1] https://blog.apnic.net/2018/04/02/apnic-labs-enters-into-a-research-agreement-with-cloudflare/ https://blog.apnic.net/2018/04/02/apnic-labs-enters-into-a-r...
  • jgrahamc 8y ago
    No
• hartator 8y ago
  Wonder if we would have a desktop version as well. Tried VPNs at some point. It was a slower and more error prone Internet experience. For doubtful privacy gains. It would awesome to have static IPs as well.
  • jgrahamc 8y ago
    Yes. As it says at the end of the post. Desktop clients will be coming soon.
    • hartator 8y ago
      Awesome missed that!
• TheCraiggers 8y ago
  > 1. We don't write user-identifiable log data to disk; That's great... but you do log user-identifiable info? How I read that is "we log things that can identify you but just keep it in memory for X amount of time". Myself and other privacy-minded folks would like to know more details there, especially as this is a freemium service.
  • bvda 8y ago
    >A VPN for People Who Don’t Know What V.P.N. Stands For I don't think their target audience includes those people (privacy minded folks.)
    • TheCraiggers 8y ago
      True. But that doesn't preclude you from offering the same amount of privacy. I suppose they want to catch abusers or find some other way of monetizing it, but that has nothing to do with the demographic they're chasing.
  • zamadatix 8y ago
    Hard not to have user identifiable info at least in memory for a network session.
  • zackbloom 8y ago
    You can read the full privacy policy here: https://www.cloudflare.com/public-resolver-mobile-privacy/ https://www.cloudflare.com/public-resolver-mobile-privacy/ The short answer is we really don't want to have data. We store bits of it for aggregate analysis and debugging, but the goal is to not be able to map traffic to individual people as quickly as possible.
• admiralpumpkin 8y ago
  Cloudflare, are there plans for ad blocking? Currently using AdGuard DNS and it works well. Router-level ad-blocking would be an attractive premium option.
  • sgc 8y ago
    Same concern here. I use the open source dns66 app with cloudflare dns so I get the best of ad blocking/content filtering and fast connections. I love the idea of improving my privacy and theoretically performance for the connections I want to make, but not at the expense of that functionality.
  • tjkrusinski 8y ago
    If Cloudflare provides CDN services for advertisers, you likely won't see adblocking products from them.
    • zackbloom 8y ago
      That is not something which has factored into the conversation on our (Cloudflare's) end. The bigger issue is even as we make technical improvements, we very much don't want to create a separate Internet. The minute we begin adding, removing, or changing content when it comes through Warp those questions begin to be asked.
      • jedberg 8y ago
        You also don't want to be in the business of determining which ads are "good" and which are "bad" and being tastemakers in any way, so probably a smart choice to stay out of the ad game. A good add on though might be a way for people to run their own service on a Cloudflare worker that gets hit with each request to 1^4, which would allow them to run their own ad blocker.
  • jerf 8y ago
    You should really want those to be separate services. The incentives get weirdly snarled if you expect your VPN to also block ads. Making it a plugin that you could plug another app into might be cool, though?
• ikeboy 8y ago
  There's a lot of dissing of competition (they drain your battery, "all suck", slow down your internet) without a single datapoint. Personally I find the performance of PIA fine. I just ran a test through fast.com and got 42 mbps on 4g through PIA mobile VPN in NYC. (Weirdly, when I turn off the VPN and test I'm only getting around 2 Mbps.) Latency is a bit higher than direct, but not enough for me to agree with their blanket statement that all VPNs suck.
  • zamadatix 8y ago
    Anything that uses the Android built in IPsec VPN is going to be fine unless the app really goes out of it's way to be crappy. This uses Wireguard in userspace so is likely actually a battery drain. Less than OpenVPN at least.
    • apexalpha 8y ago
      While it might use more power I've been using Wireguard on my phone for 6 months or so now and the performance is way better than IPSec, especially on spotty connections such a mobile!
      • mmore 8y ago
        I wonder how the increase in performance might offset the difference in battery drain between both protocols. If wireguard uses a bit more battery to achieve a task quicker the extra idle time achieved might off-set any increase in power usage.
      • fulafel 8y ago
        This sounds curious, both protocols just encapsulate your ip packets without affecting retransmissions, no?
  • JustSomeNobody 8y ago
    Fast.com is through Netflix, so your carrier is probably throttling. Try a different speed test with no VPN to confirm.
• skybrian 8y ago
  I wonder what happens if you're already using Android or Chrome Data Saver? Should you turn them off? Interesting to see competition heat up at the VPN level.
• mwcampbell 8y ago
  It seems to me that in practice, Cloudflare's mission is not actually to build a better Internet, but to offer an alternative, proprietary network (one could call it the CloudflareNet), and convince content providers and consumers to use that network. Because I don't want any single company to have too much power, I'll stick with the standard Internet, which is not owned by any single company. However, I realize that the problems with mobile Internet performance and reliability are real. So when HTTP/3 is stable, I'll do what I can to help it spread.
  • jgrahamc 8y ago
    I disagree with this statement. We haven't pushed incompatible standards or any other nonsense. We've literally pushed out the latest standards and enabled more encryption (see Universal SSL making SSL free years before Let's Encrypt; see enabling IPv6; enabling HTTP/2; etc. etc.). As for HTTP/3... so will we. See: https://blog.cloudflare.com/http-3-from-root-to-tip/ https://blog.cloudflare.com/http-3-from-root-to-tip/, https://blog.cloudflare.com/the-road-to-quic/ https://blog.cloudflare.com/the-road-to-quic/ and https://blog.cloudflare.com/head-start-with-quic/ https://blog.cloudflare.com/head-start-with-quic/.
    • petre 8y ago
      What about web sites hosted on or proxied by CF with nag screens and captchas blocking my IP? I like and use 1.1.1.1 though.
      • jgrahamc 8y ago
        We don't host web sites. What nag screens are you talking about?
        • dexterdog 8y ago
          Those "cloudflare loading" screens that come up when visiting some low-traffic sites. It's probably more common for people using privacy blockers and browser containers to block tracking. I see it at least a few times per day and I get captchas on almost any site that uses them (regardless of being behind cloudflare).
• lelf 8y ago
  https://one.one.one.one https://one.one.one.one https://1.1.1.1 https://1.1.1.1
  • mmastrac 8y ago
    Are there any other legitimate certs issued with IP address altnames?
    • lelf 8y ago
      dns.google 8888.google 8.8.8.8 8.8.4.4
      • mmastrac 8y ago
        Oddly https://8.8.8.8 https://8.8.8.8 doesn't have a legit cert though (even though the cert for 8888.google does have an IP address alt)
        • lelf 8y ago
          It does I think - Certificate[1] info: - subject `CN=Google Internet Authority G3,O=Google Trust Services,C=US', issuer `CN=GlobalSign,O=GlobalSign,OU=GlobalSign Root CA - R2', serial 0x01e3a9301cfc7206383f9a531d, RSA key 2048 bits, signed using RSA-SHA256, activated `2017-06-15 00:00:42 UTC', expires `2021-12-15 00:00:42 UTC', pin-sha256="f8NnEFZxQ4ExFOhSN7EiFWtiudZQVD2oY60uauV/n78=" - Status: The certificate is trusted.
          • maltalex 8y ago
            > Firefox does not trust this site because it uses a certificate that is not valid for 8.8.8.8. The certificate is only valid for the following names: .c.docs.google.com, .a1.googlevideo.com, .c.2mdn.net, .c.audiobooks.play.google.com, .c.bigcache.googleapis.com, .c.chat.google.com, .c.doc-0-0-sj.sj.googleusercontent.com, .c.drive.google.com, .c.googlesyndication.com, .c.googlevideo.com, .c.inbox.google.com, .c.lh3-da.googleusercontent.com, .c.lh3-da.photos0.sandbox.google.com, .c.lh3-db.googleusercontent.com, .c.lh3-db.photos1.sandbox.google.com, .c.lh3-dc.googleusercontent.com, .c.lh3-dc.photos2.sandbox.google.com, .c.lh3-dd.googleusercontent.com, .c.lh3-dd.photos3.sandbox.google.com, .c.lh3-de.googleusercontent.com, .c.lh3-de.photos4.sandbox.google.com, .c.lh3-df.googleusercontent.com, .c.lh3-df.photos5.sandbox.google.com, .c.lh3-dg.googleusercontent.com, .c.lh3-dg.photos6.sandbox.google.com, .c.lh3-dz.googleusercontent.com, .c.lh3-dz.photos-autopush.sandbox.google.com, .c.lh3.googleusercontent.com, .c.lh3.photos.google.com, .c.mail.google.com, .c.offline.maps.google.com, .c.pack.google.com, .c.play.google.com, .c.video.google.com, .c.youtube.com, .cache1.c.docs.google.com, .cache1.c.play.google.com, .cache1.c.video.google.com, .cache1.c.youtube.com, .cache2.c.docs.google.com, .cache2.c.play.google.com, .cache2.c.video.google.com, .cache2.c.youtube.com, .cache3.c.docs.google.com, .cache3.c.play.google.com, .cache3.c.video.google.com, .cache3.c.youtube.com, .cache4.c.docs.google.com, .cache4.c.play.google.com, .cache4.c.video.google.com, .cache4.c.youtube.com, .cache5.c.docs.google.com, .cache5.c.play.google.com, .cache5.c.video.google.com, .cache5.c.youtube.com, .cache6.c.docs.google.com, .cache6.c.play.google.com, .cache6.c.video.google.com, .cache6.c.youtube.com, .cache7.c.docs.google.com, .cache7.c.play.google.com, .cache7.c.video.google.com, .cache7.c.youtube.com, .cache8.c.docs.google.com, .cache8.c.play.google.com, .cache8.c.video.google.com, .cache8.c.youtube.com, .dai.googlevideo.com, .googlevideo.com, .googlezip.net, .gvt1.com, .offline-maps.gvt1.com, .snap.gvt1.com, .xn--ngstr-lra8j.com, xn--ngstr-lra8j.com
• gok 8y ago
  This sounds super cool. Any chance more of the client will be open sourced? (I presume this uses the recently-released Rust WireGuard core?)
  • jgrahamc 8y ago
    Not right now. The burden of supporting that as open source would be too high.
    • martingxx 8y ago
      Why not release anyway (for transparency) but with explicitly no support?
      • gok 8y ago
        If you don't trust them with a binary, you shouldn't trust them just because they posted source code somewhere. If they don't have the bandwidth to manage this as an open source project this is the right call.
        • martingxx 8y ago
          There are plenty of companies who have released their source code but don't support it in the same way a typical community driven project like other open source projects do. This is especially true for certain privacy and security focused applications. For example, Signal release their code, have quite a lot of users, and don't report an unmanageable overhead due to having released their source code. It's not just a matter of trusting their intentions, it's a matter of knowing that their code matches their intentions. I trust OpenSSL (mostly, these days) and I always trusted the intentions of the developers, but if their code was not open it would not be half as secure today.
      • jgrahamc 8y ago
        Because that doesn't really work. We put the code out there and people start working on it. You think we're going to be able to _not_ look at what's people are doing?
• mark_l_watson 8y ago
  I just signed up. cloudflare is on the short list of Internet companies that I trust (with the usual small bit of doubt and skepticism!). With just a few reservations, I also trust G Suite, Firefox, and a few hosting companies I do business with. I have been supporting FSF, ACLU, etc. for years, but the practical considerations that prompted me to be a bit more trusting are Cloud Search in GSuite, Cloudflare offering HTTPS to help get the web more secure, and a deep appreciation for having Firefox available (containers are so easy to use and make me feel more secure in my use of the web).
  • therealmarv 8y ago
    maybe you've forgot Cloudbleed https://en.wikipedia.org/wiki/Cloudbleed https://en.wikipedia.org/wiki/Cloudbleed Thanks for downvoting.
    • gpm 8y ago
      I trust Cloudflare to do their best, generally respect privacy, and not act maliciously. I don't trust cloudflare to not make mistakes (like Cloudbleed). I don't trust myself to not make mistakes. I don't think there is anyone I trust not to make mistakes. It's just not a reasonable criteria.
    • mark_l_watson 8y ago
      I am sorry you were downvoted - shouldn’t happen when people express their opinions. just gave you a +1
    • phpnode 8y ago
      Companies are made of people and people inevitably screw up. Cloudbleed made Cloudflare more trustworthy in my eyes simply because of how they handled their (very large, very unfortunate) mistake.
    • dang 8y ago
      Please don't complain about voting on comments. This is in the site guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html.
• moreentropy 8y ago
  While this might improve user experience for some, I don't see the greater value in a VPN solution like this. It's the fast path to replacing the decentralized internet with a few proprietary CDNs. I'm much more excited about those projects that actually try to fix the raised issues: Unencrypted connections -> TLS / Letsencrypt TCP sucks on mobile/roaming devices -> QUIC & HTTP/3
  • jgrahamc 8y ago
    Cloudflare pushed out free TLS years before Let's Encrypt and we are actively working on and supporting QUIC and HTTP/3. But QUIC/HTTP/3 aren't here today, not everyone is using HTTPS and there are other worries in coffee shops etc. hence a VPN service makes sense.
    • jpgvm 8y ago
      There is a bit of a difference between LetsEncrypt and Cloudflare TLS termination though... one is TLS for everyone, the other is TLS for Cloudflare customers (paying or not). For instance can an Iranian website use Cloudflare TLS? I would wager not. (ironic as they probably need secure transport the most). I'm not saying Cloudflare isn't doing good things for the Internet but it's a bit disingenuous to equate the 2 efforts. Cloudflare could have done LetsEncrypt, but as a CDN that would make no business sense - which is why we need LetsEncrypt, so they can continue to do the things that don't make good business sense for Cloudflare.
      • judge2020 8y ago
        CF is at the mercy of the CAs (DigiCert/Comodo), and at least based on LetsEncrypt's stance [0], they should be OK to issue .ir certificates as long as the customer is not a Gov't entity. The only issue is that these CA's are just playing it safe by not issuing any .ir domains, making CF also unable to issue .ir. I believe CF is working on LetsEncrypt certificates, at least based on letsencrypt.org being included in the 'automatic' CAA records[1]. 0: https://community.letsencrypt.org/t/issuance-criteria-for-ir-domains/81812/2 https://community.letsencrypt.org/t/issuance-criteria-for-ir... 1: https://support.cloudflare.com/hc/en-us/articles/115000310832-Certification-Authority-Authorization-CAA-FAQ https://support.cloudflare.com/hc/en-us/articles/11500031083...
• azinman2 8y ago
  There’s a lot of claims about how mobile internet sucks and this makes it not suck. But then it’s revealed it’s a WireGuard based VPN. What I don’t understand is how my internet will be so much faster than any other use of WireGuard?
  • zackbloom 8y ago
    There are a few reasons: 1. When you use WireGuard as a VPN your device is connecting to wherever you happen to have hosted your server. Cloudflare's PoPs are located in 165 different Internet exchanges and ISPs, giving you a pretty good chance to be closer to you wherever you are in the world. 2. We (Cloudflare) have tech through our Mobile SDK product which can optimize the actual way the Internet TCP traffic is mapped into UDP. 3. We also have Argo, a technology for optimizing the routing of packets through the Internet which will be released as Warp+.
    • azinman2 8y ago
      Can you go into more detail about #2? This is what I want to know more about — especially how this is faster than without any VPN.
• arendtio 8y ago
  > We built Warp around WireGuard So basically Cloudflare created an app with Cloudflare branding and set up a Wireguard server for everyone. No bad, but just check out the original: https://www.wireguard.com https://www.wireguard.com While I am not a big fan of VPNs in general, I have to admit, that Wireguard performs exceptionally well. I tested it a week ago and the added latency is pretty much just the network latency and the bandwidth loss is minimal (so small I couldn't even measure it reliably). What I found most interesting, was that there were some use-cases when the network with Wireguard performed even better than without it (probably related to congestion control).
  • apexalpha 8y ago
    From personal experience: When coupled with an DNS based ad blocker Wireguard can actually make your internet faster than when not using it. More so on Android than iOS and more so on mobile than fixed, but still feels so much smoother. you can even only forward the DNS requests and not the rest of the data so your home upload speed won't become your bottleneck.
    • obenn 8y ago
      This is precisely my setup, and I couldn't be happier. I have a lot of internal infrastructure including pi-hole, confluence and a number of self-hosted services. WireGuard lets me go anywhere on my laptop and its like I never left home, and I just keep two configurations for when I want to forward only internal IP addresses, or all my traffic.
      • walterbell 8y ago
        Any pointers on setup instructions for WireGuard split tunneling on iOS?
        • fonosip 8y ago
          not for wireguard. but for openvpn here's a howto https://ba.net/adblock/vpn/doc/howto.html https://ba.net/adblock/vpn/doc/howto.html
• rsync 8y ago
  I don't trust this, or these people. No matter what words they use, the model is a dangerous one and we should be just as wary of it coming from cloudflare as we would if it were coming from google.
  • jgrahamc 8y ago
    Why?
    • zzzcpan 8y ago
      US startups are not exactly trustworthy by default and VC backing seems to often force them to abuse any power and control they have over users for VCs benefits. And security and privacy these days more often than not is just a cover to do something bad, from simple anti-competitive practices to outright evil causes that help killing people.
    • luxuryballs 8y ago
      because he smoked too many marijuanas last night
• Abishek_Muthian 8y ago
  It's good have another VPN from a player with huge network infrastructure like Cloudflare, but the article seems to digress frequently. >TCP, the foundational protocol of the Internet, was never designed for a mobile environment. Packet loss due this is mentioned, but I don't see a relevance to the new VPN service; especially when the next section talks about wrap using UDP. > We’ve built Warp around a UDP-based protocol Other VPN providers do offer an option of choosing TCP/UDP as per usage i.e. better reliability vs faster speed. I'm glad that it uses Wireguard, but it's likely other major VPN providers are working on a Wireguard version for their clients & so in the end it would come down to speed/price/privacy which hopefully cloudflare can compete with.
  • CloudNetworking 8y ago
    > Other VPN providers do offer an option of choosing TCP/UDP as per usage i.e. better reliability vs faster speed. I don't think TCP-based VPNs are offered for increased reliability. They might be offered so you can run your VPN traffic in restricted scenarios, e.g. I run a VPN-ish service that uses TCP/443 by default and all connections are only outbound, so you can still use your VPN in restrictive scenarios. Outside that, encapsulating TCP inside TCP is nothing short of a headache as you have two congestion control algorithms kicking in and one doesn't know about the other.
• peterwwillis 8y ago
  "Hokey as it sounds, the primary reason we built Warp is that our mission is to help build a better Internet — and the mobile Internet wasn’t as fast or secure as it could be and VPNs all suck. Time and time again we've watched people sit around and talk about how the Internet could be better if someone would just act. We're in a position to act, and we've acted." By doing the least work possible: creating a proxy. They haven't actually fixed the internet at all, they just made a new middle box.
• totaldude87 8y ago
  Cloudflare is one of the companies I trust and use . But in every company's life cycle, there will be a time when some other company (Google, Facebook and other usual evils) comes forward to buy this company out, will they hold off? or will they go public? What happens next is a store for another time!
  • ocdtrekkie 8y ago
    Always continually evaluate your assumptions of who you trust, and always ensure you aren't up a creek if you have to switch providers because of an acquisition. That's why products built on open standards are great: They mean there are already alternatives readily available if you need to switch.
• kamal_k 8y ago
  Man, I hate April Fool's Day. You can't ever be sure if what you hear is real or not.
  • arendtio 8y ago
    And I thought that is always the case nowadays...
  • kukabynd 8y ago
    It’s the same when it’s not April Fool’s day, isn’t it?
• xvector 8y ago
  > 1. We don't write user-identifiable log data to disk; > 2. We will never sell your browsing data or use it in any way to target you with advertising data; Is it just me or are these terms super-specific? They can easily be circumvented to achieve real logging, especially at Cloudflare's scale. While I trust Cloudflare as a company, I feel like they're being a bit disingenuous here.
  • zackbloom 8y ago
    It's at least meant to be the opposite, specific such that you can trust we're making real promises. You can read the full privacy policy here: https://www.cloudflare.com/public-resolver-mobile-privacy/ https://www.cloudflare.com/public-resolver-mobile-privacy/
• maltalex 8y ago
  I'd wager that the Super Secret Plan is geared towards further centralizing the Internet. Preferably on Cloud Flare's infrastructure. This is one part of a tug-of-war that's going on in recent years between Internet network operators and cloud providers, with the cloud providers slowly but surely winning. For better or worse, we are moving away from a distributed Internet composed of many autonomous networks into a future in which the only job of the ISPs is to connect homes and offices to the local POPs (Points Of Presence) of the large cloud providers. Why do you need connectivity to other networks when you can get Google (w/ Youtube & GCE) and Facebook from a local POP? Add to that all the sites and services that reside on Amazon, Azure, Cloud Flare, Akamai, and maybe a few more large clouds/CDNs, and you don't need a public Internet anymore. Imagine the security and performance benefits of that!
  • mwcampbell 8y ago
    Contemplating this makes me happy that HN (among other sites I frequent) doesn't use one of these big providers (though it used to use Cloudflare). May it always stay that way.
    • auslander 8y ago
      I might have triggered the divorce :) https://news.ycombinator.com/item?id=17399783 https://news.ycombinator.com/item?id=17399783
  • penagwin 8y ago
    Here's the issue that everything fights when talking about Centralization vs Decentralization. Centralization is far easier to manage. A single entity has the ability to control all routes and all the pieces of the network. The structure can become faster, mesh-networks are notoriously slow. By using a VPN + Argo cloudflare has control over how your data is routed, and can make sure it skips slow network segments, is peered well, etc. Decentralization doesn't require trust if implemented correctly. This is it's biggest selling point IMO. If implemented correctly (which is hard to do) it can have better uptime, as we aren't relying on any single entity. But, with meshnetworks as an example, a specific route could be slower then the others, and there's often not much you can do about it. Decentralization if not implemented correctly is a nightmare on so many levels. There's nobody to appeal to if an issue occurs. If trust isn't implemented correctly (current state of ISPs) then we have multiple parties who can spy/modify your communications.
• tgtweak 8y ago
  Missed a huge opportunity to sell it for $1 per quarter ($1.$1.$1.$1/yr) People willingly pay $5-10/mo for a VPN that is nowhere near this level.
  • eastdakota 8y ago
    That's clever. We haven't set the final pricing for Warp+ yet, so it's not too late.
• EastSmith 8y ago
  Awesome! I started using 1.1.1.1 last April from the start. Later I decided I want a firewall on my Android phone as well and installed NetGuard. Unfortunately both apps can not run at the same time, because they are both "VPN". Really hope there are plans for a firewall built into 1.1.1.1 in the future.
• wrs 8y ago
  Congrats! Just a few days ago you said BoringTun is “not ready to be used in mission critical tasks” [1] — has this changed? [1] https://blog.cloudflare.com/boringtun-userspace-wireguard-rust/ https://blog.cloudflare.com/boringtun-userspace-wireguard-ru...
  • maltalex 8y ago
    1. This isn't mission critical. It's a free product that comes with no guarantees. 2. They're onboarding people slowly. You can't use it yet without an invitation.
    • wrs 8y ago
      Wow, so encouraging thousands of people to run all their mobile traffic through something doesn’t make it mission critical? How do you know what their missions are? (I don’t imagine CloudFlare would feel that way...at least I hope not.)
  • gpm 8y ago
    It looks like you can follow the security review work on the github repository. https://github.com/cloudflare/boringtun/issues?q=is%3Aissue+is%3Aopen+label%3A%22security+review%22 https://github.com/cloudflare/boringtun/issues?q=is%3Aissue+...
• t0astbread 8y ago
  Since when does Cloudflare have such a good reputation for privacy? Have I missed something?
• crooked-v 8y ago
  I wonder if this will be available on desktop at some point, or even for DD-WRT or the like.
• trpc 8y ago
  That's awesome. Is it possible to just exchange the public keys via Cloudflare's website and start using it on whatever client/platform
• redwards510 8y ago
  Currently I use PIA VPN when browsing. When I go to Cloudflare sites, I often get captchas because, in the past, I imagine someone was using PIA to abuse a Cloudflare site. So what happens when people start using Warp to hide their IP so they can hack, scan, scrape, upload malware, etc? Is Cloudflare going to show captchas to Warp users and slow down their experience? What is the plan to mitigate abuse on a free VPN that doesn't log?
  • programbreeding 8y ago
    This is basically answered in a different thread [0]. They said they're passing on the original IP of the person using Warp, so it won't work in the same way as something like PIA in that way. [0] https://news.ycombinator.com/item?id=19544845 https://news.ycombinator.com/item?id=19544845
  • dsl 8y ago
    That is why Cloudflare wants you to use their VPN rather than an anonymized one. If they can track you, they can have more data about whether to block you.
    • jgrahamc 8y ago
      Nope. We want you to use our VPN because we think it'll make your mobile Internet experience better (faster and more secure). That turns into an upsell opportunity to us and makes our core service (which people pay us for) more valuable.
      • ignoramous 8y ago
        Damn. Cloudflare's super nice customer-centric stance on this product is killing me. I quit my FAANG job just this past month to build something similar.
        • vxNsr 8y ago
          OT: What's going on in your profile? is this some sorta custom way to follow other user's posts?
• ksec 8y ago
  193 Comments and No one has asked yet. How do they make money? So, the price plan and extras from Business, Professional and Enterprise CDN is enough to cover all the cost of running the network + free tier CDN + Domain Registration Operation + DNS + Free tier VPN? There is a reason why I am using Apple. Their interest is in me using iPhone or Apple devices with a very decent profits margin, and hopefully up sell me into any convenience services like iCloud and in the future Apple Cards. They are simple and easy to understand Business Model. Even iWork, Map, and all other Services are deducted from each Apple devices sold and now accounted into Services. So how do Cloudflare make money with free VPN?
  • jgrahamc 8y ago
    In the article see the section "Ok, Sure, But You’re Still a Profit-Seeking Company"
    • lapinot 8y ago
      Relevant info being > Warp+ premium service > enterprise VPN space > So the more people who install Warp, the more valuable Cloudflare’s core services become. The last one being the key: they acknowledge they will run it even if it's not profitable. See my other comment.
    • ksec 8y ago
      Yes I read it, I am just not convinced it is financially feasible, or sustainable.
    • gist 8y ago
      It would make sense if in reply you could summarize an answer to the question and also say 'more at OK Sure," [1] For example maybe I as a user want to know but don't feel like getting stuck reading more or distracted. [1] Since you are all about speed!
  • lapinot 8y ago
    https://en.wikipedia.org/wiki/Cross_subsidization https://en.wikipedia.org/wiki/Cross_subsidization They don't make money, they just want to gain market leverage. This will make their network more interesting because of crowd effect. Akin to fb letting people create profiles/chat, google giving free search results/emails/file hosting, etc. Just finished reading a book about this, see [1] for a review. [1] https://blogs.lse.ac.uk/lsereviewofbooks/2017/06/05/book-review-platform-capitalism-by-nick-srnicek/ https://blogs.lse.ac.uk/lsereviewofbooks/2017/06/05/book-rev...
• tcd 8y ago
  Honestly, Jason is hopefully going to be thrilled Wireguard is going to be deployed to an absolutely massive scale, not even OpenVPN has been offered as a 'free VPN' like this. I'm really hoping it works out, and Cloudflare can continue to contribute their expertise working with WG. At the end of the day, this benefits everyone since OpenVPN whilst it's reliable in my experience, is just too burdensome. I also am intrigued by the price, and features that will differ between free/pro. I suspect many VPN services over the next few years will feel the effects of this (is that why they're all rushing to add 3 year plans?)
  • jgrahamc 8y ago
    We'll keep our open source Rust WireGuard code up to date with our internal version. We hope to work with the WireGuard project later once the dust has settled. Warp+ will use Argo (our "Waze" of the Internet) to improve routing. It significantly improves reliability and performance. Pricing for Warp+ will vary by region/country to ensure it's appropriately affordable everywhere.
    • mino 8y ago
      Can you talk about the details of Argo, in a blogpost or elsewhere? I'm referring to the routing logic and optimisation algos. Asked already several times in the past. I'm very curious as I've worked a lot on those specific issues. Thanks.
• paulcarroty 8y ago
  I'm impressed how good is Cloudflare from tech side. Without CL Google can track 99% of internet with their shitty AMP sooner or later.
• woofcat 8y ago
  I wonder if when accessing a Cloudflare website if they'll be presenting the website owner with the original origin IP, or passing along the 1.1.1.1 endpoint IP addressed when staying within their network.
  • prdonahue 8y ago
    We'll be presenting the original IP. If you wish to block or otherwise take action on, e.g., malicious traffic from the IP being used to connect to Warp, you'll be able to do so.
    • dsl 8y ago
      Is this in X-Forwarded-For?
      • prdonahue 8y ago
        CF-Connecting-IP is what we recommend using. See https://support.cloudflare.com/hc/en-us/articles/200170986-How-does-Cloudflare-handle-HTTP-Request-headers- https://support.cloudflare.com/hc/en-us/articles/200170986-H... for details.
        • devicenull 8y ago
          Which presumably only works if your site is using Cloudflare? Since you wouldn't be MITMing SSL in order to inject this header?
          • zackbloom 8y ago
            This is correct. It's significantly harder to inject the origin IP into a TCP stream. We have ways [1] of doing it, but it requires some coordination on both sides. 1- https://blog.cloudflare.com/mmproxy-creative-way-of-preserving-client-ips-in-spectrum/ https://blog.cloudflare.com/mmproxy-creative-way-of-preservi...
• dfgert 8y ago
  No matter how much they try to sell it as a good will gesture towards mobile users, I will not buy it. There are good examples where company starts off with good intent but later turns into a typical selfish corporation. Lets face it, every single corporation has to continuously grow, as demanded by market, which means at some point they will break their promises to implement new means of making money.
• saurik 8y ago
  From where does the user's traffic originate? Is it the closest location on that map to where they started? Is it always the same country? (I'm guessing not, as there are a lot of countries? ;P But maybe that's true for larger countries?)
• whitepoplar 8y ago
  Will it be possible to whitelist network devices and/or SSIDs? Use case: I want to be able to say, "only use VPN when on WiFi networks (not cellular), and if so, only activate on public WiFi networks (not my home WiFi).
  • ksoderstrom 8y ago
    It’s currently possible to whitelist SSIDs, and disable for cellular, for the 1.1.1.1 DNS VPN profile on iOS, so I’m assuming it will work the same way for Warp.
• rattray 8y ago
  An aside from the comment, but I don't appreciate the derisive tone of their first paragraph: > a handful of elite tech companies decide to waste the time of literally billions of people with juvenile jokes that only they find funny. I sort of agree, but it's not nice, and not necessary. It also isn't particularly classy to then go on to say "and we're so much better, because we do useful things". (I do happen to find Cloudflare, as a company, so much better, and awesome things like 1.1.1.1 and warp make me really want to push my employer to use Cloudflare for all the things).
  • redwards510 8y ago
    I think they were just trying to be extremely clear right away that this announcement is not an April Fool's joke.
  • nacs 8y ago
    I actually loved that intro. Check out Stackoverflow for a horrendous example of an April fools "joke" today.
    • nacs 8y ago
      Screenshot for people reading this outside of 4/1/2019: https://i.imgur.com/zCNbOTl.png https://i.imgur.com/zCNbOTl.png
  • roberttod 8y ago
    Absolutely, that part left a bitter taste in my mouth reading the rest of the article. Feels like they released this on April 1st just so they could make this claim, strange move.
    • oarsinsync 8y ago
      Or because (in American calendars), today is 4/1, and the IP address for their DNS server is 1.1.1.1, or four ones.
• noja 8y ago
  And HN said concentration of power is a bad thing - hey look at this free altruistic VPN!
• poisonborz 8y ago
  At least everyone should agree that using VPNs is mostly an awful experience on all devices, but many times more on mobile phones. I tried out 3-4 clients (Android) with different services/protocols and couldn't keep using it because of the resource usage, it literally halved the battery time and made the (new flagship) phone hot all the time. There has to be a better way.
• fxfan 8y ago
  jgrahamc can you please stop using google slave labor? You guys are smart enough and capable enough to have your own captcha system.
• mysterypie 8y ago
  Just as an aside, I thought that was an exceptionally well-written product announcement, or press release, or whatever you'd call it. It was long, but I didn't mind reading the whole thing. It answered all the basic questions about why I should use it, how they plan to make money, and with enough technical detail that I understood essentially how it works. It was very much the opposite of the marketing material you get from most big corporations. I'm saving the page as a PDF as a good example if and when I need to write a product announcement.
  • bbx 8y ago
    I had the same reaction. As I was reading the article, I started asking myself "Hold on, what's in it for you? You're still a private company. How are you going to make money?". I then reached the "Ok, Sure, But You’re Still a Profit-Seeking Company" section. It's as if the article was reading my mind. Every free product comes with a catch. When this catch is not clearly explained by the company, I always feel it's because the reason is too "shady" to acknowledge publicly (like Gmail and Facebook gathering data for advertisers). I'm probably naive to believe the reason here is vastly different, but the tone and style of this article puts Cloudflare closer to Apple than to Google privacy-wise in my eyes.
    • ocdtrekkie 8y ago
      The choice to omit any sort of sign-in or account feature for the app is also a very stark difference. Even most apps with the stated goal of improving your privacy requires some sort of account. While it's true that if Cloudflare was evil, they could fairly likely identify you from metadata, that's a lot more complex and a lot more error-prone than having you sign in. I am curious though if this will extend to their premium Warp+ offering though, as presumably they need to identify a paying customer. Perhaps if they're entirely built off of IAP on whatever platforms their clients are on, they can avoid this problem entirely?
      • eastdakota 8y ago
        We'll have to take payment for the paid feature, obviously, but plan to use the Apple and Google payment systems for that. I'm not an expert on the nitty gritty of that, but I don't think that gives us access to any of your personal details. We've always thought of personally identifiable information as a toxic asset and something we try to minimize collecting whenever we can.
• spurgu 8y ago
  This is so awesome from the general safety, convenience (super simple to use!) and speed perspective. I would gladly pay to have the option to be able to choose which datacenter I connect to.
• ignoramous 8y ago
  There goes me and my co-founder's plan of disrupting the Mobile VPN market. Or may be, we still have a chance? Anywho, congratulations Cloudflare! I long held an opinion that the VPN market was ripe for disruption when I looked at privacy policy of some of the top players. Having analysed the market, I find that its defragmented with no clear run-away winner. I hope you're able to make a headway with all the interesting innovations that you plan to offer on top of it. Here are some ideas that I had in mind for a Mobile VPN: 1. Ability to run a dns-blacklist, tag-based blacklist, and a ip-firewall at cloudflare's end (not on the end devices). May be you could add that as an option to your wrap+ product? 2. Auto change exit IPs underneath the covers. 3. Take over the dialer and route calls over IP whenever possible. 4. Provide ability to analyze traffic on a PC. 5. Track and warn mode per app, where the traffic is analysed for a particular app to generate a report on what its doing and how much. Basically, bring enterprise-grade security to the end consumer.
  • jgrahamc 8y ago
    I don't think what we're offering instantly takes over the entire VPN market. VPNs mean different things to different people and I'd imagine you can find a valuable market that provides things that we don't.
  • rmorey 8y ago
    Please still build this product!
    • stronglikedan 8y ago
      Indeed. A little healthy competition leads to better products all around.
  • kylec 8y ago
    My biggest concern with any VPN is: do I trust you? I’ve been reluctant to sign up with any of these VPN services that seem to be advertising everywhere nowadays because I don’t know what they’ll do with my internet traffic. The CloudFlare VPN is interesting to me because they’re a large, established company with a good reputation, so I trust them more than TunnelBear or ExpressVPN or PIA or whoever’s sponsoring YouTube this week. If there was a way you could offer a product or service that provided a compelling case for why you won’t (or better yet can’t) snoop on my internet traffic, I’m all ears. Everything else is just gravy on top.
• tuxone 8y ago
  > That many VPN companies pretend to keep your data private and then sell it to help target you with advertising is, in a word, disgusting. That is not Cloudflare’s business model and it never will be. When I read something like that I feel protected and cared about. Now, can someone explain me why this should be in any form different from the WhatsApp case?
  • almostbasic 8y ago
    Let's not forget how Cloudflare got started... The Department of Homeland Security offered to buy the data from Project Honeypot (run by Matthew Prince and Lee Holloway), and they sold it to them for $20,000. Michele Zatlyn (a classmate of Prince) said "if they'll pay for it, other people will pay for it." "And so the idea for Cloudflare was born, with Ms Zatlyn as its third co-founder." [with Prince and Holloway] Source: https://www.bbc.com/news/business-37348016 https://www.bbc.com/news/business-37348016
    • jgrahamc 8y ago
      And let's not forget who Cloudflare's customers are today: companies that pay us to make their web servers and API servers faster, more reliable and more secure.
  • felbane 8y ago
    Well, one of the big differences is the fact that you don't have to provide any information to use 1.1.1.1 or Warp, just download the app. That means that at worst, the only personally-identifiable information they get is your IP and usage patterns. If CloudFlare is bought by Comcast and they start doing Bad Guy Things™, then your exposed surface area is rather low.
• reneberlin 8y ago
  Think about it: who is behind cloudflare?
  • kim0 8y ago
    NSA ? lol
• reneberlin 8y ago
  I further correct my post: what or who will be behind cf? It's naive at it's best. "Freedom of surveilance for free" And you just slurp it. Think. Again. Think.
• IronWolve 8y ago
  My work still cant reach 1.1.1.1, but can reach 1.0.0.1, seems 1.1.1.1 was used by our ISP TWTelecom for a stub network. We opened a ticket with TW, and they just keep kicking the ticket as wont fix. But 1.0.0.1 seems to work fine.
• ratling 8y ago
  If they're going for the no-logs gimmick I'll probably just preemptively block their ASNs and save myself a lot of trouble. Did the same with Nord and a dozen other vpn-of-the-week services. no-logs means no-accountability which means malicious traffic which means you don't get to talk to our stuff.
• catern 8y ago
  >TCP, the foundational protocol of the Internet, was never designed for a mobile environment. Amusingly, this is actually not true. TCP was originally developed to run on an inter-network over two networks: the ARPANET which has the reliability characteristics of a "traditional" network, and an extremely mobile network with lots of packet loss: ship-to-ship packet radio. TCP today seems very poorly suited for the mobile environment, but it was in fact originally designed for mobile.
  • eridius 8y ago
    My interpretation of “not designed for mobile” is mobile devices, not mobile network. In particular, TCP is not designed for a scenario where the device keeps leaving old networks and joining new ones, or where a device routinely has 2 network interfaces where one has better performance than the other but which one is better changes frequently.
    • catern 8y ago
      Ships, as mobile devices, frequently entered and left packet radio range with each other, or might have multiple other ships in range and have to select which ship to send their packets to.
      • eridius 8y ago
        That would be equivalent to the server going offline and back online, as opposed to the route constantly changing.
        • catern 8y ago
          We're talking about a packet-switched network. The other ships aren't your destination - some server on land is your destination.
    • topranks 8y ago
      Multipath-TCP is designed for precisely that.
• Thaxll 8y ago
  I'm curious how they're going to manage the legal side of that project. It's free many people are going to abuse the system.
• mleonhard 8y ago
  This is attractive because I trust Cloudflare more than all of my local mobile providers.
• otterley 8y ago
  The claim that ordinary IPSec-based VPN clients (which typically use the OS kernel's IPSec facilities) "drain your battery" more than any other VPN implementation seems specious to me. Does CloudFlare have any data to support this claim?
  • auslander 8y ago
    Have a link to the statement? I'm using native iOS IKEv2 client and it has not a single issue.
• 3xblah 8y ago
  "Let's acknowledge that many corners of the consumer VPN industry are really awful so it's a reasonable question whether we have some ulterior motive. That many VPN companies pretend to keep your data private and then sell it to help target you with advertising is, in a word, disgusting. That is not Cloudflare's business model and it never will be." Therefore Warp will be open-source and its distribution will be free from the control of commercial third parties via "app stores". Those who do not wish to use an "app store" may compile Warp themselves or download binaries from their preferred repository for sideloading, e.g., F-Droid. April Fools
• mikkelam 8y ago
  I've been having tons of issues with 1.1.1.1 on my iPhone especially when jumping on and off wifi to 4G. I realise they would need to reconnect and so on, but it seems absurdly slow, so I stopped using it. I'll give warp a try though
• amingilani 8y ago
  They've glossed over a few details that I'm curious about: 1. What will the exit IPs be? Will I get to stay with-in my region and access region specific content, or can I bypass censors, both government (porn, "glory of Islam", etc), and private (Netflix region-specific content, GDPR non-compliant websites that accidentally block my region). 2. Can I select my own exit region? 3. How do they handle abuse? Can I spam and get their IP blacklisted? (I'm curious, not actually nefarious)
  • zackbloom 8y ago
    1. It will exit close to you, unless you have Warp+ in which case we might route it to a different PoP closer to your destination if that makes it faster. It is not designed to bypass censors. 2. No 3. Exactly what an actually nefarious person WOULD say!
    • amingilani 8y ago
      Thank you for your answers! > Exactly what an actually nefarious person WOULD say! It's hard to distinguish between curious and nefarious people after a point, I suppose ;) but that's still not an answer :)
• chdaniel 8y ago
  I trust and like Cloudflare a lot — a bit sad to have just bought 3 years of Nord VPN a month ago but hey, looking forward to the next renewal
• qertoip 8y ago
  A honeypot.
• bubblethink 8y ago
  How does this play with various arbitrary geoip blocks that various video on demand sites deploy ? Cloudflare being a large enough player has enough clout to affect some of these regressive practices (which I consider to be a violation of net-neutrality; a form of ip discrimination if you will). Yet, I feel that it will have the opposite effect, in that cloudflare will get whitelisted somehow much to the disadvantage of other vpn providers.
• neilv 8y ago
  VPNs are "trust me" security, and Cloudflare certainly has a better reputation than many VPN services, so, in that regard, Cloudflare's entry is welcome, but... I've been using Tor as a privacy-friendly VPN, so Cloudflare getting into this business will make it feel a bit different, every time I see an error Web page that says Cloudflare is blocking a Tor exit node from viewing a page that Cloudflare hosts. Perhaps Cloudflare could figure out how to block competitor Tor less (even if there's abuse coming in through Tor)? That might be difficult, but an excellent show of good faith.
  • rrix2 8y ago
    > Perhaps Cloudflare could figure out how to block competitor Tor less (even if there's abuse coming in through Tor)? That might be difficult, but an excellent show of good faith. they are: https://blog.cloudflare.com/cloudflare-onion-service/ https://blog.cloudflare.com/cloudflare-onion-service/
    • xxdesmus 8y ago
      Indeed, we've gone to great lengths already to make the experience over Tor less painful -- for example supporting Proxy Pass: https://blog.cloudflare.com/cloudflare-supports-privacy-pass/ https://blog.cloudflare.com/cloudflare-supports-privacy-pass... in addition to the onion service that rrix20 mentioned.
  • gpm 8y ago
    An interesting trick - if Cloudflare allows it - would be Device -> Tor -> This -> Internet. Tor provides anonymity, this provides protection against exit nodes maliciously modifying traffic (you can find a number of examples of this just by searching).
    • mirimir 8y ago
      Yes! Routing VPNs through Tor is a great way to avoid site discrimination against Tor users. But there are two key problems. One is that you degrade Tor anonymity, because Tor can't switch circuits (normally at ~10 minute interval). And also because you typically must pay for VPN services. The other problem is that Tor only routes TCP traffic. So when you use TCP-based VPNs routed through Tor, and are using HTTPS or some other TCP flavor, you get the TCP-in-TCP horrors. There's too much error correction. So yes, Cloudflare would need to allow Warp via Tor. Or maybe even better, Warp via Tor via Warp. And also it would need to protect Tor anonymity. Cool idea, though :)
• knowuh 8y ago
  I have enjoyed the elitist jokes that were on the internet and which you were probably saving for April 1ˢᵗ Forgive me they were delicious so sweet and IRONIC
• fc_barnes 8y ago
  One thing about using VPNs on the phone is that a lot of mobile/public networks only allow port 80, which prevents the VPN from connecting. If CF makes a version of wireguard that can do port 80, that would be great. As far as their bottom line, I guess this helps them sell services by having a documented number of people suckling the internet straight from the CF teat?
  • F147H34D 8y ago
    wg uses UDP. Can be configured to run on any port. If connection is restricted to TCP only, then use udptunnel.
• brunoqc 8y ago
  Some Android app doesn't work well with VPNs. It might those set to only sync on wifi. I wonder if it will improve. Google photos didn't want to sync when using the CloudFlare 1.1.1.1 app. I think I had problems with podcast apps in the past too.
• mikenew 8y ago
  Would really be nice to see this on F-Droid or available as an apk somewhere. There are still a few of us (dozens!) that are holding onto the fantasy that Android isn't just a Google service.
• Grynn 8y ago
  This is awesome! I love CloudFlare's services and I'd trust them to provide a really secure, fast VPN (free to boot!) 1. Is there a public endpoint for boringtun/noise? For playing with 2. Any chance the client (desktop) will be open source? Would love to help if possible. 3. Any interest in a WebRTC (and webRequestBlocking) based chrome extension/client? That would probably not need anything special installed on desktops and would be awesome
• kdv 8y ago
  How is Cloudflare handling IP allocation here? I might be mis-understanding how WireGuard works, but it doesn't look like there is an official method for IP dynamic assignment.
  • YjSe2GMQ 8y ago
    From what I reckon this (and almost any other VPN, or even Tor) will give you the outside appearance of the IP of the exit node. Think like NAT.
    • mercora 8y ago
      He is most likely talking about the IP address inside the tunnel which in case of WireGuard is intervened with the exchange of cryptographic keys. You can not use a DHCP server as only unicast traffic is possible.
  • mercora 8y ago
    I would like to know the answer to this too :) Maybe they are using one tunnel interface per single customer then always assign the same address to everybody and use policy routing to handle this (EDIT: just realized there might not be using the network stack at all for this and do something alike in their userspace implementation). This would not solve key exchange though. But maybe it is possible to accept any key (if the public key is transmitted this should be easy). Otherwise connecting probably requires requesting an IP address for your key prior to connecting via WireGuard to allow the endpoint to setup required configuration. This is really something WireGuard did not quite expect to be needed apparently. It is also hard to do dynamic routing with WireGuard which could also possibly allow fully meshed networks directly on top of WireGuard but i have not tried really hard yet. It would also be very useful to me to be able to have a CA so i do not have to update configuration everywhere. Last but not least its not possible to bridge the WireGuard interface at all. I have an experimental setup where i would like to use WireGuard as a sole network interface for a virtual machine, somewhat like advertised for containers where it works beautifully. However, its not possible because its not an Ethernet interface in Linux. Instead i have setup a VLAN on my switch and route traffic through WireGuard using my gateway. I would like to terminate the tunnels at the hypervisor a lot more, but don't want to route traffic there. I think all of this boils down to the usage of their cryptographic routing and trickery around it to make it work as intended. I would probably abandon WireGuard if a fork would allow my use cases as i am otherwise a really happy user.
• hultner 8y ago
  I can't find the wait list option in the app, checked App Store and I'm on the latest version. I'm using iOS 12, 1.1.1.1 user since the launch.
• oedmarap 8y ago
  This is a wonderful announcement. I'm a bit torn since on the one hand I love Cloudflare and use them extensively for my domains/servers/websites but for personal secure browsing I've been using Mullvad + WireGuard Android (with 1.1.1.1 in the config file) for a long time and it's worked flawlessly. I like both companies so maybe I'll just keep supporting Mullvad and recommend 1.1.1.1 to friends and family once Warp is in general availability (those "people who don't know what a VPN is"). Warp+ looks to be a solid business use case which I think fits well with Argo and their other offerings. Either way, it's good to have another proper VPN option outside of (self)hosted WireGuard. Many thanks for democratizing this service, as is always the case with Cloudflare.
• moneywoes 8y ago
  Would this work in China?
• rubyfan 8y ago
  Wish I would have seen this earlier wait list position is over 200K :(
• CKN23-ARIN 8y ago
  This Sounds Too Good To Be True That’s exactly what I thought when I read about the launch of Gmail exactly 15 years ago today. Is this supposed to make me less suspicious?
• Zenst 8y ago
  Given the size of the queue to join (request via their 1.1.1.1 app), I'd say get it, got a slot and by the time that comes up any issues or concerns would of been well debated. But looking good so far.
• terrycody 8y ago
  people reviewed its not working in China lol
• auslander 8y ago
  Would Warp have an option to use native (iOS/Android) VPN clients, instead of installing their app? Like, providing warp.mobileconfig configuration profile? I'm using native iOS/MacOS IKEv2 client with selected few VPN providers, and pretty happy with not having 3rd party app on my mobiles/desktops. OK. TFA says "We built Warp around WireGuard". That kills native client support.
• fukbezos 8y ago
  PIA or bust
• magicbuzz 8y ago
  I stepped thru getting some Ubuntu systems using 1.1.1.1 for DNS but retaining DHCP otherwise. Looks like this is tricky to do but some new features came in with a netplan package update that allows this to be done easily in 19.04: https://askubuntu.com/questions/1001241/can-netplan-configured-nameservers-supersede-not-merge-with-the-dhcp-nameserve https://askubuntu.com/questions/1001241/can-netplan-configur...
• terrywang 8y ago
  Almost thought this was an April fools joke (the app icon also makes it like more. While it's good to have option for non-technical people who needs to protect their network traffic and privacy, I'd stick to my own DIY WireGuard (now that we've got working client for iOS, Android and macOS, etc., also performs exceptionally well over IPsec - performance, simplicity), strongSwan based IPsec VPN as backup whenever network traffic encryption over untrusted network is required. NOTE: I doubt this won't survive longer than 3 days in China mainland (inside GFW).
  • edwinyzh 8y ago
    I couldn't even download it from the AppStore from within China mainland...
• fakename 8y ago
  Is this worth a permanent notification? Is there really no way to turn that off?
• deleted 8y ago
  [deleted]
• auslander 8y ago
  Another free service, now with a CF app on your device. Service Scope User Data DNS 1.1.1.1 users Browsing history CDN/Proxy CF protected websites SSL decrypted user forms, passwords, emails Warp VPN Warp users Device data, browsing history, apps traffic Most sensitive is raw, SSL decrypted web traffic, and users using two or more services at the same time. CF promise they don't use data, but legalese have loopholes, like do they store/use aggregated (not raw) data?
• durability 8y ago
  Anyone know how roughly how quick this is rolling out? Signed up last night and am #200kish.
• x00x 8y ago
  Can't wait to see Desktop version that works on Linux and maybe as extension on Firefox/Chrome - for those who just want to use this for browser and not other software. I've used 1.1.1.1 since day one and love it. Much faster then Google/OpenDNS for me. I actually use it on router. Maybe next you can do a better security for our WiFi? But this might require releasing a better hardware not just software.
• JoelJacobson 8y ago
  From Cloudflare's privacy policy: “2. We will never sell your browsing data or use it in any way to target you with advertising data;” Does this mean they have the right to sell browsing data for other purposes than “to target you with advertising data”? Even without any personal data, the data generated when using their DNS-service, such as statistics on domain names, can be of great value for e.g. Hedge Funds and SEO-companies wanting to know how big a domain name is based on DNS-request statistics. My question is therefore: Do they have the right to sell non-personal DNS-request statistics to third parties?
• raubtier 8y ago
  The killer vpn app would be one that guarantees that no user data ever could be collected. All software open source of course. But it would be complemented with some possibility for anyone to do an physical revision on your sites any time.
• fulafel 8y ago
  What are the tradeoffs vs using the kernel ipsec stack?
• ForFreedom 8y ago
  Is this working or I have to wait my turn at #28182982?
• Tor3 8y ago
  I'm scratching my head at this one.. I installed it, it claims that VPN is on, there's the little key in the status line as when e.g. OpenVPN is running, but pointing a browser at whatismyip.org still shows the same old IP address. So, no VPN after all?
  • Tor3 8y ago
    Replying to myself - I hadn't got that you have to apply for a spot in the waiting list, through the app. So it just does DNS through 1.1.1.1, still. Fair enough, although my routers generally do that by themselves already. However, I wish the 1.1.1.1 app didn't show that key in the status line as long as it isn't a VPN application.
• Mindwipe 8y ago
  This is very vague about where the endpoints will be. Will Cloudflare push all of the users in a given country to an exit point in their country? Can they realistically do that? Will it guarantee that, or will it vary with load? Will they detect VPNs coming into the service, or will it be a good way of laundering the VPN? Will it do anything at all as an anti censorship service? Tl:dr, I'd expect an awful lot of sites that currently block VPNs entirely (and that practice is increasing) to keep doing it here.
• repolfx 8y ago
  I guess the big question I have is why Cloudfare is a more trustable exit point than my mobile carrier is. They're both large corporations with similar privacy policies.
• throw0101a 8y ago
  I wonder what the OS/2 folks think about the name. :)
• justwonderin 8y ago
  I'm confused WRT privacy policy: https://www.cloudflare.com/public-resolver-mobile-privacy/ https://www.cloudflare.com/public-resolver-mobile-privacy/ In paragraph 2 Cloudflare says "We do not receive your phone number, device ID, IP address or any other information that could identify you when you install or use the Mobile Application." But in paragraph 4 it says "These Service Providers may only process personal information pursuant to our instructions". So which is it - do they collect personal info or not?
• gaia 8y ago
  @eastdakota, I have 1.1.1.1 at router level but when I installed the app it told me I wasn't using 1.1.1.1. Is this by design or there is possibly something wrong with my router's DNS setup?
  • justusthane 8y ago
    It's a whole different thing. If you install the 1.1.1.1 app, it's sending all your DNS lookups from your phone directly to 1.1.1.1. It doesn't care what's happening at the router level - which is kind of the point, I think. Even moreso once this Warp VPN functionality is live.
• cmurf 8y ago
  Very interesting. I've got environments where I have no control over how DNS is assigned, so I've wanted to set my phone to point to 1.1.1.1 but that also means I must have a static IP (it's DHCP or static, I can't only change DNS), but when I use static I run into a significant battery drain.[1] Using an app to work around that is a bit of a heavy hammer, but I'm gonna give it a shot. https://issuetracker.google.com/issues/112927337#comment45 https://issuetracker.google.com/issues/112927337#comment45
• megatraveller 8y ago
  This is already some news for me, waiting for the desktop information on this.
• jaimex2 8y ago
  As a content filter for schools should we be blocking 1.1.1.1 going forward?
• e844dbe8fb 8y ago
  Nothing appeals more than working for a company that specialises in censorship (catbox.moe, Daily Stormer, Archive.today). What a great option for a VPN provider.
• Tim55 8y ago
  Its good but there are still many great Mobile VPN services like PIA, PureVPN and ExpressVPN. Also They are compatible with routers so you can easily use them on it instead of using the VPN on mobile directly. https://www.purevpn.com/download/router-vpn https://www.purevpn.com/download/router-vpn https://www.expressvpn.com/vpn-software/vpn-router https://www.expressvpn.com/vpn-software/vpn-router