3 ms·

> Your connection is only really encrypted up until the CloudFlare servers, after that the connection can simply be clear text. The connection is encrypted betw

> Your connection is only really encrypted up until the CloudFlare servers, after that the connection can simply be clear text. The connection is encrypted between the browser and CloudFlare, and between CloudFlare and the website if the website has a SSL certificate, but the communication in-between remains completely visible to CloudFlare. That is a really interesting point. When you install your SSL certificate on Cloudflare and point your DNS at them, you are essentially installing Cloudflare as a "man in the middle" between your visitors and your server. Even if you have SSL between Cloudflare's servers and your in-house servers, there is technically still a point where Cloudflare terminates the SSL and can see all the traffic in plain text before they forward it on to your own servers. That is a lot of trust to be putting in Cloudflare! To be fair, though, it's just like working with any third party cloud provider. If you host on AWS, for example, you better believe sysadmins at AWS could look at all of your traffic, too, if they wanted to. So no matter what you do, if you host in the cloud at scale instead of owning your infrastructure, you have to trust third parties.

pedrocr 5y ago
Cloudfare as an SSL "MITM" was exactly what the portuguese authority responsible for running this year's census did! They then acted offended and made completly false assurances when this was pointed out. The privacy authority promptly forced them to change back.
stevenicr 5y ago
eh.. "it's just like working with any third party cloud provider" - not exactly. most cloud providers have not posted that they will actively scan what your visitors read and write to send info to three letter agencies so that men with guns can decide if freedoms you or your visitors have had should continue. It's even more interesting that the ssl and encryption stuff is so confusing that even tech focused professionals do not know it's possible - just because cloudflare is the dns used. I guess that really means that the little lock icon in the url bar is a very false sense of whatever for 18% of the web.

pedrocr 5y ago

Cloudfare as an SSL "MITM" was exactly what the portuguese authority responsible for running this year's census did! They then acted offended and made completly false assurances when this was pointed out. The privacy authority promptly forced them to change back.

stevenicr 5y ago

eh.. "it's just like working with any third party cloud provider" - not exactly. most cloud providers have not posted that they will actively scan what your visitors read and write to send info to three letter agencies so that men with guns can decide if freedoms you or your visitors have had should continue. It's even more interesting that the ssl and encryption stuff is so confusing that even tech focused professionals do not know it's possible - just because cloudflare is the dns used. I guess that really means that the little lock icon in the url bar is a very false sense of whatever for 18% of the web.