4 ms·
As a generally happy Cloudflare customer, a Cloudflare VPN makes me deeply uneasy. (Yes, I know Warp has been around for a while.) Using it means Cloudflare own
by oefrha 4y ago
As a generally happy Cloudflare customer, a Cloudflare VPN makes me deeply uneasy. (Yes, I know Warp has been around for a while.) Using it means Cloudflare owns a huge chunk of your Internet traffic end to end and decrypted, a uniquely powerful position to be in. And this is going to be default on in Edge according to TFA, even though it’s only applied to plain HTTP sites by default at the moment.
- sascha_sl 4y agoWhile I agree that it is concerning, WARP doesn't decrypt your traffic unless you sign in to ZeroTrust, enable it in your dashboard and install their CA. Not much you can do about them having decrypted traffic for sites that use them.
- oefrha 4y ago> having decrypted traffic for sites that use them Yes, that’s the huge chunk I’m talking about, and when you use them as your VPN they can effortlessly trace that decrypted traffic to you.
- sascha_sl 4y agoHow is that different from not using a VPN?
- xboxnolifes 4y agoIts not, that's the point.
- ViViDboarder 4y agoIt’s not for one party. The VPN protects your traffic from any party other than Cloudflare. Exactly as it would with any VPN.
- oefrha 4y agoWhen you don’t use a VPN, at least your traffic to Cloudflare doesn’t carry a unique ID of yours. Effort is required to correlate your traffic, especially if you are CGNAT’ed and share an IP with others, or have a dynamic IP that changes frequently.
- xani_ 4y agoBrowsers already want to send every domain you visit to cloudflare via DoH. Other options of securing DNS included "just" encrypting traffic to DNS server. But no, they decided to centralize sending DNS records via HTTPS
- AtNightWeCode 4y agoHttps is among the most broken ideas in the history of CS. I remember the first time I really learned about it and I went like it can't be this stupid. Most Internet traffic today between A and B is decrypted by C because of this.
- barsonme 4y agoWhat are you talking about?
- AtNightWeCode 4y agoHttps is a wrapper around http. The result is that any service that needs any http information can decrypt all https traffic. So on the web, passwords, apikeys, personal information and so is in general decrypted by a third party, Fastly, Akamai, Cloudflare and so on.
- barsonme 4y agoThat is entirely untrue. HTTPS is just HTTP encrypted with TLS. The only parties that can decrypt the traffic are the people with the session keys: you and the website you’re visiting.
- AtNightWeCode 4y agoYou are plain wrong.
- barsonme 4y agoHow so?
- AtNightWeCode 4y agoCause requests are often sent through any of the large third-party layer 7 reverse proxy networks that sits between the user and the origin host.
- jimlongton 4y agoPeople are fools if think there isn't a Room 641A in Cloudflare, except it's a lot better since web service operators willingly handed over all their private keys and therefore user data.