5 ms·

"You are connecting to Cloudflare and all your information is being decrypted and handed over on the fly" - wait, really?

gruez 4y ago
Yeah, because your TLS connection is with cloudflare, not the site's servers. The traffic flow looks something like this: [you] -> [cloudflare] -> [website]
nickjj 4y ago
> "You are connecting to Cloudflare and all your information is being decrypted and handed over on the fly" - wait, really? As far as I know yes, in order for them to provide their firewall service they need to be able to decrypt your traffic to filter on headers, cookies or response payload. It also means you're probably paying double the TLS handshake performance costs because both Cloudflare and your origin server will very likely have its own set of SSL certs.
- coderdd 4y ago
  Decryping is ephemeral though. No request body gets stored, except in RAM. Malicious operators etc, well that's always a possibility, but they supposedly have controls for that. And as others noted, they are not the only players in the path of serving your data.
  - nickjj 4y ago
    The TLS handshake itself is independent of how things get stored. It takes time to set up a secure connection. There are processes in place to help reduce that time for follow up requests in a short period of time (typically within the same session) but it's still CPU time and network time. Having to do this twice (Cloudflare's SSL cert + your origin's cert) is doubling those times. It could be tens of milliseconds or even hundreds since the network is involved (round trips to your server). > And as others noted, they are not the only players in the path of serving your data. There are other hops in the path to serve your data but it's just moving your encrypted bytes over the wire, decryption doesn't happen in each hop.
rad_gruchalski 4y ago
Not knowing if you are being sarcastic. Yes, like any TLS-terminating proxy.
rosmax_1337 4y ago
It might come as a suprise to many, but yes.

gruez 4y ago

Yeah, because your TLS connection is with cloudflare, not the site's servers. The traffic flow looks something like this: [you] -> [cloudflare] -> [website]

nickjj 4y ago

> "You are connecting to Cloudflare and all your information is being decrypted and handed over on the fly" - wait, really? As far as I know yes, in order for them to provide their firewall service they need to be able to decrypt your traffic to filter on headers, cookies or response payload. It also means you're probably paying double the TLS handshake performance costs because both Cloudflare and your origin server will very likely have its own set of SSL certs.

coderdd 4y ago
Decryping is ephemeral though. No request body gets stored, except in RAM. Malicious operators etc, well that's always a possibility, but they supposedly have controls for that. And as others noted, they are not the only players in the path of serving your data.
- nickjj 4y ago
  The TLS handshake itself is independent of how things get stored. It takes time to set up a secure connection. There are processes in place to help reduce that time for follow up requests in a short period of time (typically within the same session) but it's still CPU time and network time. Having to do this twice (Cloudflare's SSL cert + your origin's cert) is doubling those times. It could be tens of milliseconds or even hundreds since the network is involved (round trips to your server). > And as others noted, they are not the only players in the path of serving your data. There are other hops in the path to serve your data but it's just moving your encrypted bytes over the wire, decryption doesn't happen in each hop.

rad_gruchalski 4y ago

Not knowing if you are being sarcastic. Yes, like any TLS-terminating proxy.

rosmax_1337 4y ago

It might come as a suprise to many, but yes.