6 ms·

Not a CF employee but I am pretty sure it's working as intended as they built and use this: https://github.com/cloudflare/mitmengine https://github.com/cloudfl

Not a CF employee but I am pretty sure it's working as intended as they built and use this: https://github.com/cloudflare/mitmengine https://github.com/cloudflare/mitmengine

fulafel 3y ago
Here's hoping that, if they do it, they'll start blocking corporate TLS mitm regimes too.
- michaelt 3y ago
  Blocking? Cloudflare provides corporate TLS MITM regimes.
  - sgammon 3y ago
    "Corporate MITM" is built into the very idea of PKI. Running your own custom PKI is a completely valid way to operate a network. This is a feature because it allows anyone to establish their own trust tree, completely outside of the public certificate trust network. "Regimes" sounds pejorative but in truth, companies have a duty and in many cases a legal obligation to protect their networks. Prima facie, I don't see any reason at all why interception of traffic in this circumstance is "bad," except maybe a potential for political misuse like any other written medium. I actually think the reverse would be substantially worse: if _only_ the public trust chain was valid in major browsers, we would be completely hosed and there would be no distinguishing factor at all between remote attestation and trust. Thus, corporate TLS interception is, at worst, a necessary byproduct of a very well chosen tradeoff.
    - userbinator 3y ago
      And as a personal user, I also should have the right to intercept the traffic on my network.
      - josephcsible 3y ago
        I have a minor quibble with "my network". You should have the right to intercept the traffic originating or terminating at your devices, but not to intercept any traffic going between other people's devices just because it's on your network.
        userbinator 3y ago
        Then it wouldn't be my network anymore.
        josephcsible 3y ago
        Should your ISP be able to MITM all of your traffic just because it's going over their network? If not, then what's the difference?
      - sgammon 3y ago
        That's what I'm standing up for in this comment, but you've characterized it as opposition. I don't understand, perhaps you'd like to clarify.
        userbinator 3y ago
        I'm not opposing, just adding more context.
- rightbyte 3y ago
  Ever since Google started pushing HTTPS I understood that non-encryption would be a future privacy problem.
- yrro 3y ago
  Why? This isn't the 90s any more. You shouldn't use your employer's systems for anything other than work.
  - hedora 3y ago
    Why should they only allow MItM’ed traffic when a third party is the one defeating the encryption?
  - netsharc 3y ago
    Hah, remember how Amazon invented "Cyber-Monday"? They claim the Monday after Thanksgiving when people go back to work it'll be their first encounter with Internet-connected computers after the Thanksgiving vacation, and it's the time where they'll be most busy shopping for Christmas presents...
    - yrro 3y ago
      So that's where thta came from...
    - mynameisvlad 3y ago
      Amazon was barely a blip when Cyber Monday first came out, let alone the inventors of the term. > The term "Cyber Monday" was coined by Ellen Davis, and was first used within the ecommerce community during the 2005 holiday season. According to Scott Silverman, the head of Shop.org, the term was coined based on 2004 research showing "one of the biggest online shopping days of the year" was the Monday after Thanksgiving (12th-biggest day historically). Retailers also noted the most significant shopping period was December 5 through 15 of the previous year. In late November 2005, The New York Times reported: "The name Cyber Monday grew out of the observation that millions of otherwise productive working Americans, fresh off a Thanksgiving weekend of window shopping, were returning to high-speed Internet connections at work Monday and buying what they liked." At the time, a lot of people had slow Internet at home. The idea for having such a holiday was created by Tony Valado, in 2003 while working at 1800Flowers.com, and coined "White Wednesday" to be the day before Thanksgiving for online retailers. https://en.wikipedia.org/wiki/Cyber_Monday https://en.wikipedia.org/wiki/Cyber_Monday
- cbsmith 3y ago
  Corporate TLS mitm is so often misunderstood. There are, unfortunately, a lot of legit reasons to do so.
thegeomaster 3y ago
Use this to evade it: https://github.com/lwthiker/curl-impersonate https://github.com/lwthiker/curl-impersonate Greetings from a country whose (almost) entire IP space is blacklisted by Cloudflare!
- issafram 3y ago
  Which country?
  - kyrra 3y ago
    From his profile: > Software engineer from Belgrade, Serbia
- SOLAR_FIELDS 3y ago
  Wow thanks, I was looking for this exact piece of software a few weeks ago when testing against some geo restrictions
- pmarreck 3y ago
  necessity: still the mother of invention greetings from the other side of the world, commandline brother. I did not know of this tool, but I do now. Thanks
- foobarbazetc 3y ago
  Wow. Need this as a golang net/http shim.
rollcat 3y ago
> We consider an HTTPS connection to be intercepted when there is a mismatch between the expected client request signature corresponding to the browser identified by the User Agent, and the actual client request fingerprint of the request. Sounds like something that would be "trivial" to defeat, by means of "emulating" other TLS implementations more closely?
- homarp 3y ago
  which is what https://github.com/lwthiker/curl-impersonate https://github.com/lwthiker/curl-impersonate does: it's a special build of curl that can impersonate Chrome & Firefox
  - nwellinghoff 3y ago
    Can this be used as a proxy to your real browser? Can you paint the whole picture/setup for a noob?
    - cbsmith 3y ago
      Presumably so. You'd just need to compile the curl-impersonate for the appropriate browser you want to impersonate, and then link it in to a proxy that used libcurl for its https traffic.

Not a CF employee but I am pretty sure it's working as intended as they built and use this: https://github.com/cloudflare/mitmengine https://github.com/cloudflare/mitmengine

fulafel 3y ago

Here's hoping that, if they do it, they'll start blocking corporate TLS mitm regimes too.

michaelt 3y ago
Blocking? Cloudflare provides corporate TLS MITM regimes.
- sgammon 3y ago
  "Corporate MITM" is built into the very idea of PKI. Running your own custom PKI is a completely valid way to operate a network. This is a feature because it allows anyone to establish their own trust tree, completely outside of the public certificate trust network. "Regimes" sounds pejorative but in truth, companies have a duty and in many cases a legal obligation to protect their networks. Prima facie, I don't see any reason at all why interception of traffic in this circumstance is "bad," except maybe a potential for political misuse like any other written medium. I actually think the reverse would be substantially worse: if _only_ the public trust chain was valid in major browsers, we would be completely hosed and there would be no distinguishing factor at all between remote attestation and trust. Thus, corporate TLS interception is, at worst, a necessary byproduct of a very well chosen tradeoff.
  - userbinator 3y ago
    And as a personal user, I also should have the right to intercept the traffic on my network.
    - josephcsible 3y ago
      I have a minor quibble with "my network". You should have the right to intercept the traffic originating or terminating at your devices, but not to intercept any traffic going between other people's devices just because it's on your network.
      - userbinator 3y ago
        Then it wouldn't be my network anymore.
        josephcsible 3y ago
        Should your ISP be able to MITM all of your traffic just because it's going over their network? If not, then what's the difference?
    - sgammon 3y ago
      That's what I'm standing up for in this comment, but you've characterized it as opposition. I don't understand, perhaps you'd like to clarify.
      - userbinator 3y ago
        I'm not opposing, just adding more context.
rightbyte 3y ago
Ever since Google started pushing HTTPS I understood that non-encryption would be a future privacy problem.
yrro 3y ago
Why? This isn't the 90s any more. You shouldn't use your employer's systems for anything other than work.
- hedora 3y ago
  Why should they only allow MItM’ed traffic when a third party is the one defeating the encryption?
- netsharc 3y ago
  Hah, remember how Amazon invented "Cyber-Monday"? They claim the Monday after Thanksgiving when people go back to work it'll be their first encounter with Internet-connected computers after the Thanksgiving vacation, and it's the time where they'll be most busy shopping for Christmas presents...
  - yrro 3y ago
    So that's where thta came from...
  - mynameisvlad 3y ago
    Amazon was barely a blip when Cyber Monday first came out, let alone the inventors of the term. > The term "Cyber Monday" was coined by Ellen Davis, and was first used within the ecommerce community during the 2005 holiday season. According to Scott Silverman, the head of Shop.org, the term was coined based on 2004 research showing "one of the biggest online shopping days of the year" was the Monday after Thanksgiving (12th-biggest day historically). Retailers also noted the most significant shopping period was December 5 through 15 of the previous year. In late November 2005, The New York Times reported: "The name Cyber Monday grew out of the observation that millions of otherwise productive working Americans, fresh off a Thanksgiving weekend of window shopping, were returning to high-speed Internet connections at work Monday and buying what they liked." At the time, a lot of people had slow Internet at home. The idea for having such a holiday was created by Tony Valado, in 2003 while working at 1800Flowers.com, and coined "White Wednesday" to be the day before Thanksgiving for online retailers. https://en.wikipedia.org/wiki/Cyber_Monday https://en.wikipedia.org/wiki/Cyber_Monday
cbsmith 3y ago
Corporate TLS mitm is so often misunderstood. There are, unfortunately, a lot of legit reasons to do so.

thegeomaster 3y ago

Use this to evade it: https://github.com/lwthiker/curl-impersonate https://github.com/lwthiker/curl-impersonate Greetings from a country whose (almost) entire IP space is blacklisted by Cloudflare!

issafram 3y ago
Which country?
- kyrra 3y ago
  From his profile: > Software engineer from Belgrade, Serbia
SOLAR_FIELDS 3y ago
Wow thanks, I was looking for this exact piece of software a few weeks ago when testing against some geo restrictions
pmarreck 3y ago
necessity: still the mother of invention greetings from the other side of the world, commandline brother. I did not know of this tool, but I do now. Thanks
foobarbazetc 3y ago
Wow. Need this as a golang net/http shim.

rollcat 3y ago

> We consider an HTTPS connection to be intercepted when there is a mismatch between the expected client request signature corresponding to the browser identified by the User Agent, and the actual client request fingerprint of the request. Sounds like something that would be "trivial" to defeat, by means of "emulating" other TLS implementations more closely?

homarp 3y ago
which is what https://github.com/lwthiker/curl-impersonate https://github.com/lwthiker/curl-impersonate does: it's a special build of curl that can impersonate Chrome & Firefox
- nwellinghoff 3y ago
  Can this be used as a proxy to your real browser? Can you paint the whole picture/setup for a noob?
  - cbsmith 3y ago
    Presumably so. You'd just need to compile the curl-impersonate for the appropriate browser you want to impersonate, and then link it in to a proxy that used libcurl for its https traffic.