6 ms·

Is Cloudflare Safe Yet

64 points by rammy1234 7y ago

ceejayoz 7y ago
> Deploying RPKI is not as easy as flipping a switch as some sites would like to imply, it requires very careful planning, which can take months or years (in case equipment needs to be replaced and upgraded). So? The assertion is "they're not secure", not "it's easy to become secure". > While this is generally necessary to leverage the use of features like static file caching, it also means Cloudflare gets to see the billing details and possibly payment information of customers shopping on a Cloudflare protected e-shop. I tend to trust Cloudflare with this info more than I trust the website itself and their 83 different unpatched WordPress plugins.
- mwcampbell 7y ago
  I think the more important point, which I agree with, is that Cloudflare shouldn't be using this scare tactic, especially in the middle of a pandemic.
  - ceejayoz 7y ago
    Could you explain why security matters less during a pandemic?
    - toomuchtodo 7y ago
      You don't break critical infrastructure when it's needed the most, when what we have today is working "well enough" until a window of time presents itself when improvements can be made. You manage risk through balancing security and business requirements. You mitigate the risk you can, you accept the risk you can't (or choose to defer). Disclaimer: I work in risk. I have these conversations daily. When Cloudflare first published their RPKI marketing site, I thought it was an important issue until doing further research, and have since walked back my personal opinion (which was admittedly overzealous about RPKI initially) on the severity of the issue and the the timeline necessary for action to be taken.
      - 1over137 7y ago
        And it's not just "business requirements". Many people are now forced to work from home, and they need working internet to do so. Their paycheque and ability to buy food and shelter may now depend on it.
      - ceejayoz 7y ago
        They've been deferring for a long time. The RKPI RFC is from 2012. Cloudflare's been publishing blog articles like "RPKI - The required cryptographic upgrade to BGP routing" (https://blog.cloudflare.com/rpki/ https://blog.cloudflare.com/rpki/) for years now.
        toomuchtodo 7y ago
        And? If a central authority (or statute) doesn't dictate implementation, connectivity providers have the ability to defer forever. Customers have accepted the risk and deemed it acceptable if their provider does not support RPKI. It's their dollars to spend on connectivity, not ours.
        judge2020 7y ago
        This is going into the "America vs Europe ISPs" argument again. Americans almost always have only one ISP available to them for where they live, so they can't reasonably leave their ISP just because they don't do RPKI correctly since it would leave them without any internet, or they would have to go to satellite internet with slow speeds.
        toomuchtodo 7y ago
        Do you have a solution other than Cloudflare attempting to use their position as a large autonomous system to coerce implementation? If not, you might expect other providers to push back against such efforts.
        ceejayoz 7y ago
        > Customers have accepted the risk and deemed it acceptable if their provider does not support RPKI. That's a silly assertion. What percentage of residential ISP customers do you think are aware at all of RPKI? Cloudflare's "is BGP safe" page is intended to highlight the ISPs that are deferring RPKI. If you claim customers are making an educated decision on whether RPKI is necessary, you shouldn't have an objection to the site's existence.
    - mwcampbell 7y ago
      toomuchtodo's response covers the relative importance of security. My concern is more about taste in marketing.
  - zymhan 7y ago
    What is your worry about pointing out BGP's flaws, that folks will start panic-deploying another routing algorithm like they hoarded toilet paper?
    - mwcampbell 7y ago
      As the site itself points out, they could needlessly increase the load on their ISP's tech support.
      - zymhan 7y ago
        That would be awful! \s
  - sgammon 7y ago
    you are deeply wrong
- TekMol 7y ago
  I tend to trust Cloudflare with this info more than I trust the website itself That does not change the point of the website. Your browser tells you that the traffic to somewebsite.com is encrypted. While in reality the traffic to cloudflare is encrypted. somewebsite.com can see your data anyhow. But now on top of that, cloudflare can. And if the traffic between cloudflare and somewebsite.com is not encrypted, there might be additional parties seeing your data.
  - newuser121212 7y ago
    That flexible ssl option is a huge problem. Some years back, https:// https:// secured sited started showing injected ads and messages from an Indian ISP providing service to cloudflare there: https://medium.com/@karthikb351/airtel-is-sniffing-and-censoring-cloudflares-traffic-in-india-and-they-don-t-even-know-it-90935f7f6d98 https://medium.com/@karthikb351/airtel-is-sniffing-and-censo...
- basch 7y ago
  >more than I trust the website itself and their 83 different unpatched WordPress plugins. While cloudflare may be protecting the WordPress instance from some attacks, your traffic is still flowing back to the host eventually. It's not like Cloudflare is keeping some of the data from the website. Whereas PayPal, Apple Pay et all actually do keep some of your information from the final party by assigning one time use payment info vs handing over a credit card number.
zymhan 7y ago
This is cute but utterly unconvincing. I guess someone at one of the "insecure" companies listed at https://isbgpsafeyet.com/ https://isbgpsafeyet.com/ got a little sore?
- mwcampbell 7y ago
  Is it not plausible that this is just a concerned person speaking out? Why go straight for the most cynical take?
  - tlrobinson 7y ago
    Well, it’s clearly in response to isbgpsafeyet.com, since iscloudflaresafeyet.com was registered 2 days after the former was launched by CloudFlare https://blog.cloudflare.com/is-bgp-safe-yet-rpki-routing-security-initiative/ https://blog.cloudflare.com/is-bgp-safe-yet-rpki-routing-sec...
  - zymhan 7y ago
    I mean they literally ripped off the header design of the original Cloudflare-run BGP site. That alone makes it clear they're responding that original post, and not out of some random desire to inform people of CloudFlare's design issues.
    - mwcampbell 7y ago
      The fact that they're using smart campaign tactics doesn't imply that they're a competitor firing back rather than a concerned person taking advantage of the opportunity to draw attention to the things that concern them.
      - sgammon 7y ago
        is it you are you “they”
        mwcampbell 7y ago
oars 7y ago
"By using a VPN application like WARP, all you are doing is shifting who is able to read your traffic to someone else." Isn't that the case with all VPNs? One of the most commonly VPN use cases is to create an encrypted tunnel between your connection and another server (VPN) so that it looks like your traffic is originating from that server. Which VPN(s) doesn't allow another server to read your traffic? I thought a VPN connection has to have a VPN server which does this?
- michaelhoffman 7y ago
  That is the case with all VPNs, but that is not commonly understood by people without technical expertise who have heard that a VPN will increase their security.
cpitman 7y ago
How is the "Man in the Middle" concern different from any other CDN, like Akamai? At this point, I assume any major web presence is fronted by a CDN.
- gunn 7y ago
  It seems to be based on a site by cloudflare: https://isbgpsafeyet.com/ https://isbgpsafeyet.com/
botto 7y ago
I guess no one read all the way to the copyright > While this site is a parody, it may contain factual information. :) The author has no affiliation with Cloudflare, Inc.
- deleted 7y ago
  [deleted]
- marcrosoft 7y ago
  This is just so they don’t get sued into oblivion.
cagenut 7y ago
people who have strongly negative opinions about cloudflare are so confusing to me. literally everything they do has been done by akamai for a decade, and if you combined akamai and cloudflare and fastly and the next five biggest CDNs combined you still wouldn't even come close to touching the scope of what Amazon, FB, Google, Apple, and MS do. Its like someone freaking out at whitecastle over the dangers of fast food and the environmental impact of beef. You're not necessarily wrong... just your aim is so wierd.
hyperpape 7y ago
The natural reading of the URL is that the author will expose some surprising way that being a customer of Cloudflare is unsafe. Instead, there's a mixture of the well-known (but valid!) MITM concerns and a hodgepodge of other crap. It would be better titled "my complaints about Cloudflare" but that's not good enough clickbait. This deserves to be flagged.
shirshak55 7y ago
I trust cloudflare more than my ISP. And regarding dns I trust next dns over 1.1.1.1. And I trust 1.1.1.1 more than 8.8.8.8 which is ran by ads company. I would like to thanks cloudflare for their service.
r1ch 7y ago
I'm a bit surprised to not see criticism of their SSL options. For a security company, Cloudflare makes it incredibly easy to set up insecure configurations to your origin. There are four SSL options to choose from, but only one is actually secure and it usually defaults to one of the insecure options.
godman_8 7y ago
This website is wrong in so many ways. Cloudflare isn't perfect and too much centralization is an issue but the arguments in this are wrong and emotional. "Cloudflare is shielding cybercriminals" So? Criminals use many good services, it doesn't make the service bad. "Scaring internet users into thinking their ISPs are insecure in the middle of a global pandemic" ISPs ARE insecure because of this. The global pandemic has nothing to do with this. Do we get mad at CVEs all of sudden during a pandemic? "Falsely advertising their VPN application" It can be safer depending on the situation. If you need model closer to zero-trust (still not zero-trust though) use Tor.
- judge2020 7y ago
  To add: > Cloudflare is shielding cybercriminals Cloudflare has an abuse form https://cloudflare.com/abuse https://cloudflare.com/abuse - CF also doesn't prohibit you from filing police reports with your local law enforcement, which CF will cooperate with upon receiving contact. > Scaring internet users into thinking their ISPs are insecure in the middle of a global pandemic https://hn.algolia.com/?q=bgp https://hn.algolia.com/?q=bgp
detaro 7y ago
funnily enough, apparently Cloudflare did also accept invalid routes, at least from the client-side? https://twitter.com/Benjojo12/status/1251538757595148291 https://twitter.com/Benjojo12/status/1251538757595148291 (entire thread is IMHO a good take on this)
edf13 7y ago
Why flagged?
sgammon 7y ago
this is ridiculous and misleading no CloudFlare is not decrypting traffic my lord as if a VPN tunnel is such a bad thing
sgammon 7y ago
That’s a lot of words for “I’m unable to secure BGP at my shit ISP and now I blame cloudflare for my ineptitude and bad press”

64 points by rammy1234 7y ago

> Deploying RPKI is not as easy as flipping a switch as some sites would like to imply, it requires very careful planning, which can take months or years (in case equipment needs to be replaced and upgraded). So? The assertion is "they're not secure", not "it's easy to become secure". > While this is generally necessary to leverage the use of features like static file caching, it also means Cloudflare gets to see the billing details and possibly payment information of customers shopping on a Cloudflare protected e-shop. I tend to trust Cloudflare with this info more than I trust the website itself and their 83 different unpatched WordPress plugins.

mwcampbell 7y ago
I think the more important point, which I agree with, is that Cloudflare shouldn't be using this scare tactic, especially in the middle of a pandemic.
- ceejayoz 7y ago
  Could you explain why security matters less during a pandemic?
  - toomuchtodo 7y ago
    You don't break critical infrastructure when it's needed the most, when what we have today is working "well enough" until a window of time presents itself when improvements can be made. You manage risk through balancing security and business requirements. You mitigate the risk you can, you accept the risk you can't (or choose to defer). Disclaimer: I work in risk. I have these conversations daily. When Cloudflare first published their RPKI marketing site, I thought it was an important issue until doing further research, and have since walked back my personal opinion (which was admittedly overzealous about RPKI initially) on the severity of the issue and the the timeline necessary for action to be taken.
    - 1over137 7y ago
      And it's not just "business requirements". Many people are now forced to work from home, and they need working internet to do so. Their paycheque and ability to buy food and shelter may now depend on it.
    - ceejayoz 7y ago
      They've been deferring for a long time. The RKPI RFC is from 2012. Cloudflare's been publishing blog articles like "RPKI - The required cryptographic upgrade to BGP routing" (https://blog.cloudflare.com/rpki/ https://blog.cloudflare.com/rpki/) for years now.
      - toomuchtodo 7y ago
        And? If a central authority (or statute) doesn't dictate implementation, connectivity providers have the ability to defer forever. Customers have accepted the risk and deemed it acceptable if their provider does not support RPKI. It's their dollars to spend on connectivity, not ours.
        judge2020 7y ago
        This is going into the "America vs Europe ISPs" argument again. Americans almost always have only one ISP available to them for where they live, so they can't reasonably leave their ISP just because they don't do RPKI correctly since it would leave them without any internet, or they would have to go to satellite internet with slow speeds.
        toomuchtodo 7y ago
        Do you have a solution other than Cloudflare attempting to use their position as a large autonomous system to coerce implementation? If not, you might expect other providers to push back against such efforts.
        ceejayoz 7y ago
        > Customers have accepted the risk and deemed it acceptable if their provider does not support RPKI. That's a silly assertion. What percentage of residential ISP customers do you think are aware at all of RPKI? Cloudflare's "is BGP safe" page is intended to highlight the ISPs that are deferring RPKI. If you claim customers are making an educated decision on whether RPKI is necessary, you shouldn't have an objection to the site's existence.
  - mwcampbell 7y ago
    toomuchtodo's response covers the relative importance of security. My concern is more about taste in marketing.
- zymhan 7y ago
  What is your worry about pointing out BGP's flaws, that folks will start panic-deploying another routing algorithm like they hoarded toilet paper?
  - mwcampbell 7y ago
    As the site itself points out, they could needlessly increase the load on their ISP's tech support.
    - zymhan 7y ago
      That would be awful! \s
- sgammon 7y ago
  you are deeply wrong
TekMol 7y ago
I tend to trust Cloudflare with this info more than I trust the website itself That does not change the point of the website. Your browser tells you that the traffic to somewebsite.com is encrypted. While in reality the traffic to cloudflare is encrypted. somewebsite.com can see your data anyhow. But now on top of that, cloudflare can. And if the traffic between cloudflare and somewebsite.com is not encrypted, there might be additional parties seeing your data.
- newuser121212 7y ago
  That flexible ssl option is a huge problem. Some years back, https:// https:// secured sited started showing injected ads and messages from an Indian ISP providing service to cloudflare there: https://medium.com/@karthikb351/airtel-is-sniffing-and-censoring-cloudflares-traffic-in-india-and-they-don-t-even-know-it-90935f7f6d98 https://medium.com/@karthikb351/airtel-is-sniffing-and-censo...
basch 7y ago
>more than I trust the website itself and their 83 different unpatched WordPress plugins. While cloudflare may be protecting the WordPress instance from some attacks, your traffic is still flowing back to the host eventually. It's not like Cloudflare is keeping some of the data from the website. Whereas PayPal, Apple Pay et all actually do keep some of your information from the final party by assigning one time use payment info vs handing over a credit card number.

zymhan 7y ago

This is cute but utterly unconvincing. I guess someone at one of the "insecure" companies listed at https://isbgpsafeyet.com/ https://isbgpsafeyet.com/ got a little sore?

mwcampbell 7y ago
Is it not plausible that this is just a concerned person speaking out? Why go straight for the most cynical take?
- tlrobinson 7y ago
  Well, it’s clearly in response to isbgpsafeyet.com, since iscloudflaresafeyet.com was registered 2 days after the former was launched by CloudFlare https://blog.cloudflare.com/is-bgp-safe-yet-rpki-routing-security-initiative/ https://blog.cloudflare.com/is-bgp-safe-yet-rpki-routing-sec...
- zymhan 7y ago
  I mean they literally ripped off the header design of the original Cloudflare-run BGP site. That alone makes it clear they're responding that original post, and not out of some random desire to inform people of CloudFlare's design issues.
  - mwcampbell 7y ago
    The fact that they're using smart campaign tactics doesn't imply that they're a competitor firing back rather than a concerned person taking advantage of the opportunity to draw attention to the things that concern them.
    - sgammon 7y ago
      is it you are you “they”
      - mwcampbell 7y ago

oars 7y ago

"By using a VPN application like WARP, all you are doing is shifting who is able to read your traffic to someone else." Isn't that the case with all VPNs? One of the most commonly VPN use cases is to create an encrypted tunnel between your connection and another server (VPN) so that it looks like your traffic is originating from that server. Which VPN(s) doesn't allow another server to read your traffic? I thought a VPN connection has to have a VPN server which does this?

michaelhoffman 7y ago
That is the case with all VPNs, but that is not commonly understood by people without technical expertise who have heard that a VPN will increase their security.

cpitman 7y ago

How is the "Man in the Middle" concern different from any other CDN, like Akamai? At this point, I assume any major web presence is fronted by a CDN.

gunn 7y ago
It seems to be based on a site by cloudflare: https://isbgpsafeyet.com/ https://isbgpsafeyet.com/

botto 7y ago

I guess no one read all the way to the copyright > While this site is a parody, it may contain factual information. :) The author has no affiliation with Cloudflare, Inc.

deleted 7y ago
[deleted]
marcrosoft 7y ago
This is just so they don’t get sued into oblivion.

cagenut 7y ago

people who have strongly negative opinions about cloudflare are so confusing to me. literally everything they do has been done by akamai for a decade, and if you combined akamai and cloudflare and fastly and the next five biggest CDNs combined you still wouldn't even come close to touching the scope of what Amazon, FB, Google, Apple, and MS do. Its like someone freaking out at whitecastle over the dangers of fast food and the environmental impact of beef. You're not necessarily wrong... just your aim is so wierd.

hyperpape 7y ago

The natural reading of the URL is that the author will expose some surprising way that being a customer of Cloudflare is unsafe. Instead, there's a mixture of the well-known (but valid!) MITM concerns and a hodgepodge of other crap. It would be better titled "my complaints about Cloudflare" but that's not good enough clickbait. This deserves to be flagged.

shirshak55 7y ago

I trust cloudflare more than my ISP. And regarding dns I trust next dns over 1.1.1.1. And I trust 1.1.1.1 more than 8.8.8.8 which is ran by ads company. I would like to thanks cloudflare for their service.

r1ch 7y ago

I'm a bit surprised to not see criticism of their SSL options. For a security company, Cloudflare makes it incredibly easy to set up insecure configurations to your origin. There are four SSL options to choose from, but only one is actually secure and it usually defaults to one of the insecure options.

godman_8 7y ago

This website is wrong in so many ways. Cloudflare isn't perfect and too much centralization is an issue but the arguments in this are wrong and emotional. "Cloudflare is shielding cybercriminals" So? Criminals use many good services, it doesn't make the service bad. "Scaring internet users into thinking their ISPs are insecure in the middle of a global pandemic" ISPs ARE insecure because of this. The global pandemic has nothing to do with this. Do we get mad at CVEs all of sudden during a pandemic? "Falsely advertising their VPN application" It can be safer depending on the situation. If you need model closer to zero-trust (still not zero-trust though) use Tor.

judge2020 7y ago
To add: > Cloudflare is shielding cybercriminals Cloudflare has an abuse form https://cloudflare.com/abuse https://cloudflare.com/abuse - CF also doesn't prohibit you from filing police reports with your local law enforcement, which CF will cooperate with upon receiving contact. > Scaring internet users into thinking their ISPs are insecure in the middle of a global pandemic https://hn.algolia.com/?q=bgp https://hn.algolia.com/?q=bgp

detaro 7y ago

funnily enough, apparently Cloudflare did also accept invalid routes, at least from the client-side? https://twitter.com/Benjojo12/status/1251538757595148291 https://twitter.com/Benjojo12/status/1251538757595148291 (entire thread is IMHO a good take on this)

edf13 7y ago

Why flagged?

sgammon 7y ago

this is ridiculous and misleading no CloudFlare is not decrypting traffic my lord as if a VPN tunnel is such a bad thing

sgammon 7y ago

That’s a lot of words for “I’m unable to secure BGP at my shit ISP and now I blame cloudflare for my ineptitude and bad press”