10 ms·
A public letter to CloudFlare to fix their snoopy vendor
- blastonico 5y agoPoor Snoopy, after a terrible experience at the supermarket, now this! :-( https://www.youtube.com/watch?v=nD2n7Jiy-xY https://www.youtube.com/watch?v=nD2n7Jiy-xY
- blastonico 5y agoDownvoted because of a simple and inoffensive joke that relates to Peanut' Snoopy character. The lords of seriousness don't tolerate humor.
- ushakov 5y agowhat are the use-cases for cloudflare in front of GitHub pages?
- tananaev 5y agoGitHub has a traffic limit. If you serve mostly static data, Cloudflare can cache most of it, so you stay within GitHub limits.
- BillinghamJ 5y agoThis is answered quite clearly in the linked page. GitHub Pages originally didn't support SSL on custom domains, so people would often put Cloudflare in front of it. Now GHP does support SSL on custom domains, so Cloudflare is no longer needed, but obviously a lot of sites still exist with the original setup.
- MaulingMonkey 5y ago> GitHub Pages originally didn't support SSL on custom domains, so people would often put Cloudflare in front of it. I've done this myself and I'm fixing it now! (Some JavaScript APIs I've experimented with over the years require HTTPS - from WebAuthn, which hey, fair enough - to Web MIDI, which hey, what the heck? https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts/features_restricted_to_secure_contexts https://developer.mozilla.org/en-US/docs/Web/Security/Secure... )
- notRobot 5y agoEven the webcam API requires HTTPS, I guess that makes sense?
- ameliaquining 5y agoIf it didn't, then whenever you visited a non-HTTPS site, an MITM could inject code into the page that turns your webcam on and then spies on you. Permission prompts help somewhat with this, but not really enough, given that the address bar provides no clue that you're not talking to who you think you are (beyond the generic "Not secure" warning that users usually ignore since it's so common). Allowing this would be a total disaster for user privacy.
- notRobot 5y agoAh, that makes a lot of sense! Hadn't even considered that, thanks!
- ameliaquining 5y agoWeb MIDI isn't for playing .mid files in the browser. It's for letting in-browser JavaScript talk to arbitrary hardware devices that speak the MIDI protocol; this includes not only things like keyboards and synthesizers, but also stage lighting systems and other theatrical devices that use MIDI as a control protocol (so that you can have, e.g., lighting and sound cues happen in sync, because they're all centrally controlled by a single computer). In general, any API that controls hardware counts as security-sensitive; you don't want MITMs to be able to hijack your hardware devices and make them do something bad.
- tialaramex 5y agoThe major browser vendors committed to all genuinely new features being Secure context only. Secure context means either HTTPS or the local machine. If the feature is something you could do with a polyfill anyway then it's not really a new feature, it usually makes no sense to restrict it. But something like Web MIDI you clearly can't build with a polyfill, so restricting that makes sense. The reason to do this for new features is that by definition if your HTTP site already works, it didn't use them, if it relied on features that didn't exist it didn't work. So this prevents backsliding, your HTTPS site might stop working if you downgrade it to HTTP, but your 1997 HTTP site still works since obviously that doesn't use Web MIDI, or indeed probably CSS. For a few features, vendors are going back and removing Insecure Context support, but this work is slow because inevitably even if it was a terrible idea people relied on it working (e.g. EME is used extensively from HTTP, because you know you really care that people can't pirate your mediocre training video, but you don't care enough to prevent them trivially intercepting it during download...)
- deleted 5y ago[deleted]
- whymarrh 5y agoGitHub Pages also doesn’t (yet) support custom headers and you can add them with Cf via Workers. So if you’re concerned about the results of securityheaders.io, for example, you can add those in.
- lbotos 5y agoFeedback: I might suggest changing "Now Resolved/ Not Resolved" to Resolved/Broken. This could help with readability as right now there is 1 char difference and it took me a few times to parse.
- captn3m0 5y agoThe column was quite misleading, as "resolved" doesn't mean that airtel is no longer trying to block it. (it's trying, but failing). As such, I've just dropped the column.
- tomklein 5y agoWhat if the site owners change their SSL settings to Full SSL though?
- captn3m0 5y agoIt fixes the issue, and that has been the recommended fix I've been offering developers all this while.
- paco3346 5y agoSo really website owners are just misusing Cloudflare? How is this Cloudflare's fault?
- captn3m0 5y agoIn this case, it is not a random party in the CloudFlare--GitHub connection (say a network operator in UK). The snooping intermediary (Airtel) in this scenario is one that has a commercial relationship with CloudFlare and powers CloudFlare's network. CloudFlare has been aware of this issue for years, but it hasn't done anything to get its vendor to fix their network.
- celsoazevedo 5y agoIsn't the censorship applied by Airtel, Jio, etc, because of local laws? https://en.wikipedia.org/wiki/Internet_censorship_in_India https://en.wikipedia.org/wiki/Internet_censorship_in_India I don't see how Cloudflare or any other provider can make Airtel "fix" the snooping when Airtel is forced by law to block those sites. This seems to be a policy/government problem, not a Cloudflare or Airtel problem.
- captn3m0 5y agoThere is no court order to block neovim.io or teachyourselfcs.com. Airtel isn’t forced to block these sites. It is blocking these because of a mis-configuration somewhere.
- bratao 5y agoPlease Cloudflare, I'm a paying customer and have some IPv6 only users that are very frustrated every time they see a Cloudflare challenge page. Your provider, HCaptcha still do not support IPv6. I have to use workarounds like an alternative domain without CF and this is very frustrating.
- ahupp 5y agoIt's a little hard for me to believe that there are IPv6-only users out there. Who are these people? edit: I realize there are plenty users behind NAT64 gateways etc, that's the point: how many users out there have no IPv4 connectivity at all?
- hetspookjee 5y agoMost users from KPN (largest dutch telco) are stuck with just a IPV6 address. Phoning home is often quite a bit of a challenge.
- gruez 5y agoI think the parent poster isn't asking whether you only get an ipv6 address, but rather you only get an ipv6 address without some sort of CGNAT for ipv4
- JimDabell 5y agoIt’s super common for cellular networks. Apple even has a rule for the App Store to reject any applications that don’t work in an IPv6-only environment because of this. They’ve had this rule for six years.
- jaywalk 5y agoMust be smaller providers doing this? In the US, we've got CGNAT IPv4 and regular IPv6 for cellular.
- 5y ago
- r1ch 5y agoGlad to see this getting attention. Flexible SSL is an awful option that has no place in the modern encrypted web. Out of the four SSL options Cloudflare gives users, only one is actually secure. It's a huge foot-gun.
- jrochkind1 5y agoI assume you mean only ` Full (strict)` is secure, and not even `Full`? I happened to be recently looking at putting cloudflare in front of an S3 bucket, and it looked maybe easier/more feasible to do with `Full` instead of `Full (Strict)` -- because you can skip configuring the S3 bucket have an SSL cert for your actual front-facing domain (which can be cumbersome and/or more expensive to set up) and just let CloudFlare connect to it as `*.s3.aws.com` or whatever. As long as CloudFlare is actually requiring a trusted cert for *.s3.aws.com, are there security implications I'm missing for why this is a bad idea? (I guess AWS or someone with the keys to AWS certs could be spoofing you? Anything else?) Or in general even without reference to this use case, explain vulnerability examples/threat models for `Full` without `Strict`?
- r1ch 5y agoFull does not check certificates, so a MITM can supply any untrusted certificate and intercept your traffic. Only Full (Strict) does trusted cert checking.
- ewuhic 5y ago"Can" theoretically, or there's a valid attack vector which one may pull off immediately in the wild?
- captn3m0 5y agoThe current Airtel scenario is a good demonstration I’d say.
- r1ch 5y agoCloudflare terminates SSL at the point closest to the user, so any of the ISPs between Cloudflare's POP and the origin could MITM the traffic. Normally an untrusted MITM cert would throw up a TLS error, but since the Cloudflare <-> End User part is trusted, a MITM attack with anything but Full (Strict) is undetectable to an end user. There's plenty of examples of ISPs trying this in the wild: https://www.zdnet.com/article/kazakhstan-government-is-now-intercepting-all-https-traffic/ https://www.zdnet.com/article/kazakhstan-government-is-now-i... https://www.reddit.com/r/sysadmin/comments/4vy3op/my_isp_is_trying_to_intercept_some_of_my_https/ https://www.reddit.com/r/sysadmin/comments/4vy3op/my_isp_is_... https://superuser.com/questions/176651/isp-replaces-ssl-certificates-any-solution https://superuser.com/questions/176651/isp-replaces-ssl-cert...
- AtNightWeCode 5y agoAges ago Cloudflare started to advice against these kinds of setups. I did not even know it was still possible. TLS termination on the edge services is just stupid.
- samwillis 5y agoDisagree. TLS terminated at the edge, by a trusted partner, is perfectly valid and in many cases a great plus. You should, however, then always have a tls connection back to the main host, this is obviously not always the case and is wrong. Ideally CloudFlare would not make it possible. By terminating at the edge it enables many useful features of services such as CloudFlare that would otherwise not be possible such as the “web application firewall”. If you think of CloudFlare as a hosting provider in the same way as any other (which they are) it ridiculous not to trust them terminating TLS.
- AtNightWeCode 5y agoTLS termination in the sense that you terminate TLS and then send the traffic to the origins without encryption. Cloudflare services basically works at layer 7 so they must decrypt all the traffic.
- samwillis 5y agoAh, your original comment was not clear, we agree then. I'm just frustrated by the bandwagoning criticism of any use of CloudFlare and the suggestion anyone using them is MITM their own visitors, when clearly they are just another part of your own infrastructure (when used correctly). Your comment "TLS termination on the edge services is just stupid" made me think you were doing that.
- alisonkisk 5y ago
- oefrha 5y agoTLS termination on the edge services wasn’t stupid back when crappy vendors (Github Pages included) didn’t support TLS. GitHub Pages only added TLS for custom domains in 2018.
- deleted 5y ago[deleted]
- amingilani 5y agoCloudflare powered censorship in Pakistan works in a similar fashion. ISPs block websites, but because Cloudflare's data center forwards using local ISPs, you get a nice secure blocked page.
- captn3m0 5y agoI did come across several reports from Pakistani users as well while researching for this today. Do these ISPs limit themselves to court-ordered blocks in your case?
- IA21 5y agoCould you also mention Turkey & Pakistan in your letter as well?
- 0xbkt 5y agoSame here in Turkey. But this one is an int'l transit provider. Posted this[0] months ago, even sent emails to Cloudflare NOC multiple times and nobody did even care. [0] https://community.cloudflare.com/t/censored-pop-orpheus-not-working-around-hostile-outbound-upstream-in-there/308498 https://community.cloudflare.com/t/censored-pop-orpheus-not-...
- adhipics 5y ago
- adhipics 5y ago[flagged]
- p0cc 5y agoThese are the five SSL options for a Cloudflare website [0]: 1. No SSL: User <--HTTP--> Cloudflare <--HTTP--> Origin Server 2. Flexible SSL: User <--HTTPS--> Cloudflare <--HTTP--> Origin Server 3. Full SSL: User <--HTTPS--> Cloudflare <--HTTPS--> Origin Server; Self-signed cert ok, expired cert ok 4. Full SSL (strict): User <--HTTPS--> Cloudflare <--HTTPS--> Origin Server; Origin server must use an SSL certificate that Cloudflare provides [1] 5. Strict (SSL-Only Origin Pull): User <--HTTPS--> Cloudflare <--HTTPS--> Origin Server; same as Full SSL (strict), but you pay need to pay Cloudflare more money --- 3 and above will fix this issue as they encrypt from Cloudflare to the Origin Server. This is the traffic flow from the link: User -> Cloudflare -> Airtel -> GitHub Pages Where the connection with flexible SSL is Cloudflare <--HTTP--> GitHub Pages. Upgrading to Full SSL (or higher) and using HTTPS on GitHub [2] should fix. --- Alternatively, deploy your static website with Cloudflare Pages [3], which has feature parity with Github Pages. The flow would then be: User <--HTTPS--> Cloudflare Pages [0]: https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes https://developers.cloudflare.com/ssl/origin-configuration/s... [1]: https://developers.cloudflare.com/ssl/origin-configuration/origin-ca https://developers.cloudflare.com/ssl/origin-configuration/o... [2]: https://docs.github.com/en/pages/getting-started-with-github-pages/securing-your-github-pages-site-with-https https://docs.github.com/en/pages/getting-started-with-github... [3]: https://pages.cloudflare.com/ https://pages.cloudflare.com/ EDIT: The replies by kentonv, x1110dc, and r1ch all have valid points.
- r1ch 5y agoNote that while option 3 will fix this particular issue (because they only seem to care about port 80), it doesn't stop them from MITMing the connection with their own self-signed cert in the future. Only options 4 and 5 ensure a fully secure SSL connection.
- kentonv 5y ago> 5. Strict (SSL-Only Origin Pull): User <--HTTPS--> Cloudflare <--HTTPS--> Origin Server; same as Full SSL (strict), but you pay need to pay Cloudflare more money The difference in this mode is that even if the client connects to Cloudflare using HTTP, Cloudflare will connect to the origin using HTTPS. In all other modes, if the client connects by HTTP, then Cloudflare will connect to origin by HTTP. Of course, most people these days enable "HTTPS only", in which case Cloudflare will redirect HTTP clients to HTTPS and therefore not make any connection to the origin at all for HTTP clients.
- adhipics 5y ago
- ceda_ei 5y agoI ran into the same issue a few weeks ago. https://news.ycombinator.com/item?id=29685966 https://news.ycombinator.com/item?id=29685966
- throwaway888abc 5y agoCloudflare is not doing anything wrong, why to pick that call ? Airtel support is here https://www.airtel.in/contact-us https://www.airtel.in/contact-us Also, vote with your wallet and don't use Airtel ?
- miohtama 5y agoEven better: vote for a party that is not BJP? :)
- nodelessness 5y agoYes vote for congress.
- sangeeth96 5y agoOh but they are. They chose Airtel in their locations. I'm using BSNL as my ISP but my request goes to one of these locations that seems to be using Airtel and I get the same DoT block message.
- captn3m0 5y agoUsers who are not Airtel customers are impacted.
- ghostly_s 5y agoI read the page and there seems to be nothing to back up the claim that this vendor is "snoopy?"
- kiririn 5y agoIn the early 2010s for a couple of years all Cloudflare websites would sometimes fail to load on my home connection - 20% or so of page loads would hit a strange error, some sort of tcp or ssl issue It’s good to see others experience the downside of centralising the internet. Until reading this, it seemed like everyone blindly loves cloudflare.
- 0xdeadb00f 5y agoAre there alternatives to this service CF provides?
- Zdh4DYsGvdjJ 5y agoWhy not use Github Pages without Cloudflare? It also supports native IPv6 if that was the reason. https://news.ycombinator.com/item?id=28710629 https://news.ycombinator.com/item?id=28710629
- captn3m0 5y agoA lot of the impacted websites are old, from before GitHub Pages offered TLS support.
- Anunayj 5y agoI also tried reporting this issue to Cloudflare in the past through their hackerone page (since I was out of ideas where to get the request though), this is the response I got: > Enabling SSL/TLS between Cloudflare and the origin site is a customer decision. When this protection is not enabled, as is the case here, an ISP can manipulate the requests before they reach Cloudflare. If this behaviour is not desired, the customer must change the settings for the site in the Cloudflare dashboard. The request in question gets MITMed after it reaches Cloudflare edge servers, the connection between browser and the edge server happens over SSL
- technick 5y agoCouldn't you just setup a proxy or VPN in the "cloud" and bypass all of this?
- captn3m0 5y agoActually, no. I run these tests on Digital Ocean servers in Bangalore, which almost always hits the DEL Cloudflare POP, where Airtel is the upstream and blocks the connection. To fix this, an Indian user must actively avoid Cloudflare POPs, which is a bad proposition. Also, it shouldn’t be up to end-users of Neovim to fix what is CF/Airtel’s fault.