6 ms·

Cloudflare is now powering Microsoft Edge Secure Network

154 points by jgrahamc 3y ago

candiddevmike 3y ago
Microsoft acquiring Cloudflare would be a very interesting acquisition, probably similar to them acquiring GitHub.
focusedone 3y ago
I don't feel less spied on by passing all of my traffic through anything related to Microsoft.
- deleted 3y ago
  [deleted]
supriyo-biswas 3y ago
I really hate to be that guy, but I'm afraid that Cloudflare partnering with every browser to offer a VPN is just going to draw the attention of authorities, who would force them to install their censorship policies and force flow logging on all proxying services of this kind, effectively killing the purpose of such services. There is already precedent for this happening in Russia; in that incident every VPN pulled out of the country. However if everyone enforces it, it's gonna be hard. -- From a purely technical perspective this seems to equivalent to Apple Private Relay _iff_ the operator for the ingress and egress are two different endpoints, which it is not clear from the presentation. In the case of APR Apple has their own servers (mask-h2.icloud.com) that accepts connections and obscures the IP <-> website mapping for their exit relay providers, who are Cloudflare, Akamai and Fastly at the moment. If they are the same operator, because of the ClientHello permutation in Chromium based browsers[1] such as Edge, Cloudflare gets a high-entropy identifier + IP address, which, along with SNI header inspection, could be theoretically used to identify individual users. [1] https://www.fastly.com/blog/a-first-look-at-chromes-tls-clienthello-permutation-in-the-wild https://www.fastly.com/blog/a-first-look-at-chromes-tls-clie...
- greyface- 3y ago
  > authorities [...] would force them to install [...] flow logging This doesn't necessarily require Cloudflare's cooperation. Remember when the NSA tapped Google's internal network without their knowledge? SSL added and removed here :-)
  - lokar 3y ago
    Not really internal. Long distance fiber lines between sites, mostly leased.
    - greyface- 3y ago
      They were DC<->DC fiber links, carrying unencrypted Stubby RPC traffic. Internal is an accurate descriptor.
      - ethbr1 3y ago
        Suffice to say internal to Google's network architecture at the time, subsequently remediated with encryption, but physically external to Google DCs. It did raise a fascinating question about where the physical tap was and how the take was routed back. You do the tap at a hub, and you have the egress connectivity, but you're one unexpected employee away from discovery. You do the tap in the middle of nowhere, and how do you get the data stream back? I'd guess they went rural and just leased physically adjacent dark fiber to route out on.
        pests 3y ago
        The return routes are most likely in the same run but just a different strand. I think this is the way underwater cables are tapped - no need for a completely new run back.
        cavisne 3y ago
        Level 3 basically admitted they did it for them, so it would have been at a hub.
gjsman-1000 3y ago
So, Microsoft Edge now comes with an equivalent to Apple’s Private Relay, just without Apple as a middleman between Cloudflare and Fastly. Neat. On the other hand… I have to hand it to Cloudflare, they’ve done a great job turning themselves into the internet’s second backbone. (AWS might as well be the third backbone.) It seems that decentralized systems always centralize over time when it comes to mindshare, and really don’t like decentralizing. Like, once the network effects begin even slightly, it becomes irreversible quickly. Linux is still not beating Windows and Mac. Mastodon’s numbers are still tiny compared to Twitter. Bitcoin hasn’t really hurt banks. The internet started out fairly decentralized, look at it now. I’ve come to the conclusion that people just do not like decentralized anything, period. Which is unfortunate.
- pocketarc 3y ago
  > always centralize over time when it comes to mindshare Yeah, you're absolutely right. Companies grow, and people talk about them, and get other people to try them, and they grow more, and more, until it becomes the "default" option that everyone knows, and they become entrenched by sheer power of their mindshare. Especially in a global world where these brands become larger than life. There are brands with more global recognition and soft power than most countries out there. Most people go with the defaults. That goes for software as much as companies. It doesn't matter how many decentralised options you have, because mindshare is what matters. Being the default in people's minds is what matters. You need hosting? AWS. CDN? CloudFlare. Git? GitHub. Video? YouTube. And so on. There -are- options. But people aren't going to bother, when they can just... go with the default. It's not about people not liking decentralisation, it's just much more mental effort to research and explore options when you can just go with the default.
- mdasen 3y ago
  > So, Microsoft Edge now comes with an equivalent to Apple’s Private Relay It's only 5GB for free. Microsoft doesn't have a paid option yet so we'll have to wait and see what that costs.
pogue 3y ago
I didn't read the entire article, but it sounds like it's just a very old school port 80 proxy type "VPN" not dissimilar to Opera's VPN.
- Arnavion 3y ago
  Yes, all the proxy companies of the 2000s realized that the "Private" in "Virtual Private Network" makes for good marketing, so they all rebranded themselves as VPNs, even though they have nothing to do with actual VPNs other than using OpenVPN / Wireguard for their proxy transport.
audessuscest 3y ago
CF is really on fire recently https://blog.cloudflare.com/ https://blog.cloudflare.com/
- edwinbalani 3y ago
  Their posts in the last few days are all tagged "Birthday Week", so I guess their PR office has been queueing them all up for a little while.
  - 015a 3y ago
    Traditionally at Cloudflare, Birthday Week is the "release new products" week; they're not writing announcements for products that they've already shipped, but rather Birthday Week is the deadline every year for a ton of big new products that are being built.
Am4TIfIsER0ppos 3y ago
So cloudflare can now MITM all the other servers that don't agree to use their services?
- _lvbh 3y ago
  VPN does not override TLS unless you install their root certificates or something
thedaly 3y ago
Interesting. I imagine it would be difficult to effectively block cloudflare VPN IPs without also blocking content from a lot of other sites.
- johnklos 3y ago
  That's exactly their game. They want to be in a position where they can host whomever they like, no matter how spammy / scammy / attacky, and there isn't anything anyone can do about it without lots of collateral damage.
elashri 3y ago
Maybe a little bit off topic. But Edge secure network is maybe the only way in egypt to have semi stable VPN. Egypt aggressively block VPN on protocol level and using combined arsenal of blocking capabilities to do that. Doing handshaking ia maybe more dangerous than visiting ISIS propaganda website in the US (when this was a thing). The only other reliable way to do it is via ssh tunneling and Tor private bridges. But these two have their own problems. I doubt that they would ban Microsoft Edge network specially that to do that now a lot of things in windows and cloudflare network will stop working which is not something that can be done. Egyptian ISPs used to hijack DNS for all reasons (and some are scary of course). They would ban port 443 to prevent people from using DoH if they could without technically cut Egypt out of internet. So yes normally this is not something most of people here are not going to like. But as usual reminder, the world is much bigger than US and the western Europe.
mcbrienollie 3y ago
You cannot "secure" the internet by centralizing all the traffic into a specific place. Internet meant to be decentralized by its own nature. Cloudflare is just one of the companies which is trying to monopolize the whole industry by the partnerships.
tempodox 3y ago
So “Microsoft” and “Secure” in the same sentence is actually a thing?
- tempodox 3y ago
  Apparently not: https://news.ycombinator.com/item?id=37702095 https://news.ycombinator.com/item?id=37702095
betaby 3y ago
Endgame I suppose is to forbid IP-IP communications and allow only gated platform to gated platform communications.
secondcoming 3y ago
I use Cloudflare WARP, and I get a ridiculous amount of "PR_END_OF_FILE_ERROR" connection errors to random websites in Firefox. You just have to keep refreshing.
- SerCe 3y ago
  Last time I experienced an issue with FireFox and WARP, it was due to a bug in FireFox, which I believe is currently unresolved. It's honestly hard to blame Cloudflare in this case. [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1734110 https://bugzilla.mozilla.org/show_bug.cgi?id=1734110
wbl 3y ago
If I understand correctly it's a one-hop proxy. This seems strictly inferior to what Apple is doing with Private Relay where there are two separated hops, and given that I wonder what the Privacy Pass token is actually doing here.
_8j50 3y ago
When will mozilla file an ftc complaint against cloufdflare? It is impossible to access important sites including their own portal from firefox at times, no matter what I disable in firefox. This is anti-compettitive and hostile against the public at large? I wish I had a lawyer friend that can advise in this. Do I just need to get a bunch if people to submit similar complaints somehow to FTC? Sue them directly? Email the DoJ? It's an active hostility I can't avoid, what are my options?
- SerCe 3y ago
  Last time I experienced an issue with FireFox and WARP, it was due to a bug in FireFox, which I believe is currently unresolved. It's honestly hard to blame Cloudflare in this case. [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1734110 https://bugzilla.mozilla.org/show_bug.cgi?id=1734110
  - SerCe 3y ago
    Ah, sorry, accidentally replied in a wrong thread.
TechTechTech 3y ago
All fun and games, till some day Microsoft acquires Cloudflare and the internet effectively becomes one big corporate intranet.

154 points by jgrahamc 3y ago

candiddevmike 3y ago

Microsoft acquiring Cloudflare would be a very interesting acquisition, probably similar to them acquiring GitHub.

focusedone 3y ago

I don't feel less spied on by passing all of my traffic through anything related to Microsoft.

deleted 3y ago
[deleted]

supriyo-biswas 3y ago

I really hate to be that guy, but I'm afraid that Cloudflare partnering with every browser to offer a VPN is just going to draw the attention of authorities, who would force them to install their censorship policies and force flow logging on all proxying services of this kind, effectively killing the purpose of such services. There is already precedent for this happening in Russia; in that incident every VPN pulled out of the country. However if everyone enforces it, it's gonna be hard. -- From a purely technical perspective this seems to equivalent to Apple Private Relay _iff_ the operator for the ingress and egress are two different endpoints, which it is not clear from the presentation. In the case of APR Apple has their own servers (mask-h2.icloud.com) that accepts connections and obscures the IP <-> website mapping for their exit relay providers, who are Cloudflare, Akamai and Fastly at the moment. If they are the same operator, because of the ClientHello permutation in Chromium based browsers[1] such as Edge, Cloudflare gets a high-entropy identifier + IP address, which, along with SNI header inspection, could be theoretically used to identify individual users. [1] https://www.fastly.com/blog/a-first-look-at-chromes-tls-clienthello-permutation-in-the-wild https://www.fastly.com/blog/a-first-look-at-chromes-tls-clie...

greyface- 3y ago
> authorities [...] would force them to install [...] flow logging This doesn't necessarily require Cloudflare's cooperation. Remember when the NSA tapped Google's internal network without their knowledge? SSL added and removed here :-)
- lokar 3y ago
  Not really internal. Long distance fiber lines between sites, mostly leased.
  - greyface- 3y ago
    They were DC<->DC fiber links, carrying unencrypted Stubby RPC traffic. Internal is an accurate descriptor.
    - ethbr1 3y ago
      Suffice to say internal to Google's network architecture at the time, subsequently remediated with encryption, but physically external to Google DCs. It did raise a fascinating question about where the physical tap was and how the take was routed back. You do the tap at a hub, and you have the egress connectivity, but you're one unexpected employee away from discovery. You do the tap in the middle of nowhere, and how do you get the data stream back? I'd guess they went rural and just leased physically adjacent dark fiber to route out on.
      - pests 3y ago
        The return routes are most likely in the same run but just a different strand. I think this is the way underwater cables are tapped - no need for a completely new run back.
      - cavisne 3y ago
        Level 3 basically admitted they did it for them, so it would have been at a hub.

gjsman-1000 3y ago

So, Microsoft Edge now comes with an equivalent to Apple’s Private Relay, just without Apple as a middleman between Cloudflare and Fastly. Neat. On the other hand… I have to hand it to Cloudflare, they’ve done a great job turning themselves into the internet’s second backbone. (AWS might as well be the third backbone.) It seems that decentralized systems always centralize over time when it comes to mindshare, and really don’t like decentralizing. Like, once the network effects begin even slightly, it becomes irreversible quickly. Linux is still not beating Windows and Mac. Mastodon’s numbers are still tiny compared to Twitter. Bitcoin hasn’t really hurt banks. The internet started out fairly decentralized, look at it now. I’ve come to the conclusion that people just do not like decentralized anything, period. Which is unfortunate.

pocketarc 3y ago
> always centralize over time when it comes to mindshare Yeah, you're absolutely right. Companies grow, and people talk about them, and get other people to try them, and they grow more, and more, until it becomes the "default" option that everyone knows, and they become entrenched by sheer power of their mindshare. Especially in a global world where these brands become larger than life. There are brands with more global recognition and soft power than most countries out there. Most people go with the defaults. That goes for software as much as companies. It doesn't matter how many decentralised options you have, because mindshare is what matters. Being the default in people's minds is what matters. You need hosting? AWS. CDN? CloudFlare. Git? GitHub. Video? YouTube. And so on. There -are- options. But people aren't going to bother, when they can just... go with the default. It's not about people not liking decentralisation, it's just much more mental effort to research and explore options when you can just go with the default.
mdasen 3y ago
> So, Microsoft Edge now comes with an equivalent to Apple’s Private Relay It's only 5GB for free. Microsoft doesn't have a paid option yet so we'll have to wait and see what that costs.

pogue 3y ago

I didn't read the entire article, but it sounds like it's just a very old school port 80 proxy type "VPN" not dissimilar to Opera's VPN.

Arnavion 3y ago
Yes, all the proxy companies of the 2000s realized that the "Private" in "Virtual Private Network" makes for good marketing, so they all rebranded themselves as VPNs, even though they have nothing to do with actual VPNs other than using OpenVPN / Wireguard for their proxy transport.

audessuscest 3y ago

CF is really on fire recently https://blog.cloudflare.com/ https://blog.cloudflare.com/

edwinbalani 3y ago
Their posts in the last few days are all tagged "Birthday Week", so I guess their PR office has been queueing them all up for a little while.
- 015a 3y ago
  Traditionally at Cloudflare, Birthday Week is the "release new products" week; they're not writing announcements for products that they've already shipped, but rather Birthday Week is the deadline every year for a ton of big new products that are being built.

Am4TIfIsER0ppos 3y ago

So cloudflare can now MITM all the other servers that don't agree to use their services?

_lvbh 3y ago
VPN does not override TLS unless you install their root certificates or something

thedaly 3y ago

Interesting. I imagine it would be difficult to effectively block cloudflare VPN IPs without also blocking content from a lot of other sites.

johnklos 3y ago
That's exactly their game. They want to be in a position where they can host whomever they like, no matter how spammy / scammy / attacky, and there isn't anything anyone can do about it without lots of collateral damage.

elashri 3y ago

Maybe a little bit off topic. But Edge secure network is maybe the only way in egypt to have semi stable VPN. Egypt aggressively block VPN on protocol level and using combined arsenal of blocking capabilities to do that. Doing handshaking ia maybe more dangerous than visiting ISIS propaganda website in the US (when this was a thing). The only other reliable way to do it is via ssh tunneling and Tor private bridges. But these two have their own problems. I doubt that they would ban Microsoft Edge network specially that to do that now a lot of things in windows and cloudflare network will stop working which is not something that can be done. Egyptian ISPs used to hijack DNS for all reasons (and some are scary of course). They would ban port 443 to prevent people from using DoH if they could without technically cut Egypt out of internet. So yes normally this is not something most of people here are not going to like. But as usual reminder, the world is much bigger than US and the western Europe.

mcbrienollie 3y ago

You cannot "secure" the internet by centralizing all the traffic into a specific place. Internet meant to be decentralized by its own nature. Cloudflare is just one of the companies which is trying to monopolize the whole industry by the partnerships.

tempodox 3y ago

So “Microsoft” and “Secure” in the same sentence is actually a thing?

tempodox 3y ago
Apparently not: https://news.ycombinator.com/item?id=37702095 https://news.ycombinator.com/item?id=37702095

betaby 3y ago

Endgame I suppose is to forbid IP-IP communications and allow only gated platform to gated platform communications.

secondcoming 3y ago

I use Cloudflare WARP, and I get a ridiculous amount of "PR_END_OF_FILE_ERROR" connection errors to random websites in Firefox. You just have to keep refreshing.

SerCe 3y ago
Last time I experienced an issue with FireFox and WARP, it was due to a bug in FireFox, which I believe is currently unresolved. It's honestly hard to blame Cloudflare in this case. [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1734110 https://bugzilla.mozilla.org/show_bug.cgi?id=1734110

wbl 3y ago

If I understand correctly it's a one-hop proxy. This seems strictly inferior to what Apple is doing with Private Relay where there are two separated hops, and given that I wonder what the Privacy Pass token is actually doing here.

_8j50 3y ago

When will mozilla file an ftc complaint against cloufdflare? It is impossible to access important sites including their own portal from firefox at times, no matter what I disable in firefox. This is anti-compettitive and hostile against the public at large? I wish I had a lawyer friend that can advise in this. Do I just need to get a bunch if people to submit similar complaints somehow to FTC? Sue them directly? Email the DoJ? It's an active hostility I can't avoid, what are my options?

SerCe 3y ago
Last time I experienced an issue with FireFox and WARP, it was due to a bug in FireFox, which I believe is currently unresolved. It's honestly hard to blame Cloudflare in this case. [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1734110 https://bugzilla.mozilla.org/show_bug.cgi?id=1734110
- SerCe 3y ago
  Ah, sorry, accidentally replied in a wrong thread.

TechTechTech 3y ago

All fun and games, till some day Microsoft acquires Cloudflare and the internet effectively becomes one big corporate intranet.