3 ms·

That's one line in the announcement and is not the core of what we announced. This eSIM provide a data connection that goes directly to Cloudflare.

deleted 4y ago
[deleted]
ayewo 4y ago
How does this data connection work in practice? Sounds like you have to become an MVNO, no?
- Nextgrid 4y ago
  They will essentially be an MVNO, yes. It doesn't address security much though - the carrier's infrastructure still needs to be trusted and there is no end-to-end encryption between the mobile device and Cloudflare (you'd still need an on-device VPN for that - this is a limitation of the mobile protocols; the network is considered trusted and is given access to the traffic). The eSIMs that Cloudflare uses also need to be properly segregated away so that the carrier's customer support people can't reissue those SIMs, which they can technically do as they are still considered the issuer and their system is in control of the issuing process.
vinay_ys 4y ago
This blog post doesn't read like rest of Cloudflare posts. It is very beating around the bush and doesn't get to the point at all. Please consider updating the blog for clarity and brevity.
Nextgrid 4y ago
But the data connection is not end-to-end encrypted to CF. The SIM authenticates you to the mobile network which is free to tamper with your traffic. Considering the "security" of the equipment in there, as well as the incentives of the people working there and the general level of skill and development practices in there, I wouldn't trust it at all. The only way this would be secure is if the SIM/eSIM is able to embed an actual client certificate which the mobile device can then use to initiate a VPN connection to Cloudflare, but this would also require the eSIM to not be able to be tampered with by the issuing carrier, otherwise they could potentially push an update to extract the keys or have it sign malicious requests in the background.
- gz5 4y ago
  This ^. Alternative is to put authorization into the app w/ a resultant VPN-like encrypted connection through mTLS verified overlay network which has no access to your data plane keys. So no MNO access and E2E encrypted session from the process space of the app client to the process space of the app server (or peer). Examples of this alternative here: https://github.com/openziti-test-kitchen/go-http https://github.com/openziti-test-kitchen/go-http

deleted 4y ago

[deleted]

ayewo 4y ago

How does this data connection work in practice? Sounds like you have to become an MVNO, no?

Nextgrid 4y ago
They will essentially be an MVNO, yes. It doesn't address security much though - the carrier's infrastructure still needs to be trusted and there is no end-to-end encryption between the mobile device and Cloudflare (you'd still need an on-device VPN for that - this is a limitation of the mobile protocols; the network is considered trusted and is given access to the traffic). The eSIMs that Cloudflare uses also need to be properly segregated away so that the carrier's customer support people can't reissue those SIMs, which they can technically do as they are still considered the issuer and their system is in control of the issuing process.

vinay_ys 4y ago

This blog post doesn't read like rest of Cloudflare posts. It is very beating around the bush and doesn't get to the point at all. Please consider updating the blog for clarity and brevity.

Nextgrid 4y ago

But the data connection is not end-to-end encrypted to CF. The SIM authenticates you to the mobile network which is free to tamper with your traffic. Considering the "security" of the equipment in there, as well as the incentives of the people working there and the general level of skill and development practices in there, I wouldn't trust it at all. The only way this would be secure is if the SIM/eSIM is able to embed an actual client certificate which the mobile device can then use to initiate a VPN connection to Cloudflare, but this would also require the eSIM to not be able to be tampered with by the issuing carrier, otherwise they could potentially push an update to extract the keys or have it sign malicious requests in the background.

gz5 4y ago
This ^. Alternative is to put authorization into the app w/ a resultant VPN-like encrypted connection through mTLS verified overlay network which has no access to your data plane keys. So no MNO access and E2E encrypted session from the process space of the app client to the process space of the app server (or peer). Examples of this alternative here: https://github.com/openziti-test-kitchen/go-http https://github.com/openziti-test-kitchen/go-http