6 ms·

I really hate to be that guy, but I'm afraid that Cloudflare partnering with every browser to offer a VPN is just going to draw the attention of authorities, wh

I really hate to be that guy, but I'm afraid that Cloudflare partnering with every browser to offer a VPN is just going to draw the attention of authorities, who would force them to install their censorship policies and force flow logging on all proxying services of this kind, effectively killing the purpose of such services. There is already precedent for this happening in Russia; in that incident every VPN pulled out of the country. However if everyone enforces it, it's gonna be hard. -- From a purely technical perspective this seems to equivalent to Apple Private Relay _iff_ the operator for the ingress and egress are two different endpoints, which it is not clear from the presentation. In the case of APR Apple has their own servers (mask-h2.icloud.com) that accepts connections and obscures the IP <-> website mapping for their exit relay providers, who are Cloudflare, Akamai and Fastly at the moment. If they are the same operator, because of the ClientHello permutation in Chromium based browsers[1] such as Edge, Cloudflare gets a high-entropy identifier + IP address, which, along with SNI header inspection, could be theoretically used to identify individual users. [1] https://www.fastly.com/blog/a-first-look-at-chromes-tls-clienthello-permutation-in-the-wild https://www.fastly.com/blog/a-first-look-at-chromes-tls-clie...

greyface- 3y ago
> authorities [...] would force them to install [...] flow logging This doesn't necessarily require Cloudflare's cooperation. Remember when the NSA tapped Google's internal network without their knowledge? SSL added and removed here :-)
- lokar 3y ago
  Not really internal. Long distance fiber lines between sites, mostly leased.
  - greyface- 3y ago
    They were DC<->DC fiber links, carrying unencrypted Stubby RPC traffic. Internal is an accurate descriptor.
    - ethbr1 3y ago
      Suffice to say internal to Google's network architecture at the time, subsequently remediated with encryption, but physically external to Google DCs. It did raise a fascinating question about where the physical tap was and how the take was routed back. You do the tap at a hub, and you have the egress connectivity, but you're one unexpected employee away from discovery. You do the tap in the middle of nowhere, and how do you get the data stream back? I'd guess they went rural and just leased physically adjacent dark fiber to route out on.
      - pests 3y ago
        The return routes are most likely in the same run but just a different strand. I think this is the way underwater cables are tapped - no need for a completely new run back.
      - cavisne 3y ago
        Level 3 basically admitted they did it for them, so it would have been at a hub.
- Tiberium 3y ago
  That Google incident sounds interesting, do you have links to the technical explanations? From a quick search all I could find are news reports.
  - formerly_proven 3y ago
    It's from the OG PRISM slides. Previously Google's internal production network didn't use encryption, SSL/TLS was terminated at the perimeter. So the NSA simply tapped their dark fiber between data centers.
- supriyo-biswas 3y ago
  But it becomes significantly easier if Cloudflare performs this cooperation; most ISPs are required to maintain such data as well.
ignoramous 3y ago
Except, Cloudflare already proxies 10% or more of all HTTP traffic (has plaintext access to most of it). If the authorities wanted to DPI away, there's already more to look at even without these VPN offerings. > From a purely technical perspective this seems to be a slightly worse version of Apple Private Relay. Private Relay is a well thought out design. Microsoft Edge Secure Network is merely a proxy because it is built for a different threat model: https://archive.is/pNnW5 https://archive.is/pNnW5
- supriyo-biswas 3y ago
  DPI at ISPs or Cloudflare isn't really what I'm concerned about; it's the impending destruction of the VPN service model by mandating censorship and logging.
  - adventured 3y ago
    I'll be curious to see what tactics they (the political block in the West that's acting in quasi concert to enhance domestic espionage capabilities) attempt to use to accomplish it in the US given the enshrined protections we have that Europeans typically lack, which in theory should make it very difficult to censor VPNs here. The logging requirement aspect may end up being the part they can more readily get through in the US (one that will survive freedom of speech etc challenges).
  - ignoramous 3y ago
    VPNs aren't the solution to surveillance and censorship. Tor-style networks are better suited. Some of which are already in the process of standardization by the IETF. > DPI at ISPs or Cloudflare isn't really what I'm concerned about Well, ~50% content of the comment I replied to comprised of these "non-concerns".
    - methou 3y ago
      The usability of Tor is very PGP like. Personally I never seen one or introduced to one vibrant / healthy society. Also it's trend since a long time ago, people don't really mention about Tor sites on the clear net. (Ye, I know about the hiddenwiki)
Dah00n 3y ago
Seems to me NSA likely already have internal access at CF as they do at Apple, looking at what Snowden released + time passed, so it is a likely next step.
gruez 3y ago
>However, in this case, and because of the ClientHello permutation in Chromium based browsers[1] such as Edge, Cloudflare gets a high-entropy identifier + IP address, which, along with SNI header inspection, could be theoretically used to identify individual users. As per your own source, a different permutation is used per connection, so it's unclear how it would help to "identify individual users".
- supriyo-biswas 3y ago
  I stand corrected wrt the operators; while the diagram mentions that there is an ingress and egress component, it is not clear as to whether two different entities operate them. I've updated my comments to reflect that. Iff they're the same operator, I assume there'd be a TLS connection between Microsoft Edge Secure and the Edge browser, and that'd be a long-lived session because of the nature of proxying traffic, which means there's a static identifier. Even if it wasn't, IP addresses may themselves be considered as sensitive enough for such identification.
tomwheeler 3y ago
> I really hate to be that guy, but I'm afraid that Cloudflare partnering with every browser to offer a VPN is just going to draw the attention of authorities On the bright side, maybe they'll protect it with their "One more step...please wait while we verify your browser" system, which has such a high false positive rate (in my experience) that few people could actually access it.
- Arnavion 3y ago
  That only blocks people with secure, locked-down browsers, so it won't be a problem for Edge users.
kgeist 3y ago
>There is already precedent for this happening in Russia; in that incident every VPN pulled out of the country. However if everyone enforces it, it's gonna be hard. Not only that, ISPs now close all connections which look like VPN traffic. I used to have my own OpenVPN server as a window to the free world and now it doesn't work... I wish there was some kind of open standard which doesn't leave a very obvious signature which is easy to detect by ISPs. I don't know if HTTP CONNECT can be hidden from ISPs? I guess I'm going to try Edge after all.
- supriyo-biswas 3y ago
  You could look into Shadowsocks, V2Ray and similar. It's also been a while I've read about these topics, so I'm not sure if Russia also does entropy analysis and fingerprinting differences to block these protocols either. You may like reading about the new TSPU system in Russia [1], and discussing your issues on [2]. [1] https://censoredplanet.org/tspu https://censoredplanet.org/tspu [2] http://ntc.party http://ntc.party
- _lvbh 3y ago
  The Chinese have been fighting this war for a while. The results are in favor of users: see Trojan-gfw, Xray-core, v2ray
- gerdesj 3y ago
  Try switching to 443/tcp or try a high port like 10000/udp. The first might look rather like streaming over https and the second like an encrypted RTP stream in a mad SIP n RTP session. You can also co-exist OpenVPN on 443/tcp with a "real" web server. The usual use case for that is getting more value out of a single IP address. Put your pony fan club website up or an Ubuntu default webpage. Another possibility is to use port knocking to open ports before the OVPN connects.
  - gerdesj 3y ago
    ... and now I come to think of it: PPTP is generally believed to be broken so it might be "allowed" because it will be assumed that grabbing and storing the stream will be sufficient for later analysis. Then you put a OpenVPN inside the PPTP tunnel with proper, modern encryption. ... 53/tcp or udp might be worth trying too. 123/udp - ntp, 25/tcp - email! Basically try being weird - it may well work!
NicoJuicy 3y ago
What is Russia going to do? Block 30% of the web and 90% of the most important sites?
- Raymonf 3y ago
  Maybe eventually? https://www.scientificamerican.com/article/russia-is-trying-to-leave-the-internet-and-build-its-own/ https://www.scientificamerican.com/article/russia-is-trying-...
- KirillPanov 3y ago
  China does.
  - NicoJuicy 3y ago
    China isn't blocking cloudflare, cloudflare has a separate network for China https://www.cloudflare.com/application-services/products/china-network/ https://www.cloudflare.com/application-services/products/chi...
    - supriyo-biswas 3y ago
      China is blocking the RoW Cloudflare since websites and web hosting services need to be officially certified by the government by way of an ICP recordal. Many CDNs set up a China specific network which customers can use it subject to presenting their recordal; that’s what Cloudflare China is.
      - NicoJuicy 3y ago
        So... Not blocking cloudflare China?
neom 3y ago
You should do some research on Matthew Prince, his background is very interesting. He's pretty much the only tech CEO who I could say "yeah, I trust him". I'm not saying your concern isn't valid, it's a great point. Only that if anyone was going to run a company like Cloudflare, we're lucky it's Matthew, he's not a dumbass.
- Minor49er 3y ago
  He runs the largest man-in-the-middle service online. I wouldn't put an ounce of trust into him
- austhrow743 3y ago
  I read his wiki. Didn’t see anything of the hates three letter agencies or the American government variety. I did see this: > In 2008, the Department of Homeland Security (DHS) contacted Unspam Technologies, asking, "Do you have any idea how valuable the data you have is?" The DHS' email served as the impetus for Cloudflare, a technology company Prince co-founded with Holloway and fellow Harvard Business School graduate Michelle Zatlyn the following year. Which sounds like the opposite of what we would want. Cloudflare being started because a three letter agency told him that harvesting internet data is valuable. Unless his take away was “they do that too? Better try to stop it!” Is there something else you’re referring to?
- jjav 3y ago
  > Only that if anyone was going to run a company like Cloudflare, we're lucky it's Matthew, he's not a dumbass. This may be totally true, but it's extremely important to understand that it does not matter. As a US-based company Cloudflare is subject to NSLs (https://en.wikipedia.org/wiki/National_security_letter https://en.wikipedia.org/wiki/National_security_letter) which will force them to reveal all traffic and never talk about it. There's nothing they can do to resist that, regardless of founder personality. Combine this with the fact that Cloudflare terminates TLS traffic, so it's all in the clear within their infrastructure. It would be difficult to think of a more juicy target for intelligence agencies waving NSLs. It'll all be classified so we'll never know (unless some future Snowden tell us). But it is logical and wise to assume all traffic passing through Cloudflare is siphoned off in cleartext to the TLAs.

greyface- 3y ago

> authorities [...] would force them to install [...] flow logging This doesn't necessarily require Cloudflare's cooperation. Remember when the NSA tapped Google's internal network without their knowledge? SSL added and removed here :-)

lokar 3y ago
Not really internal. Long distance fiber lines between sites, mostly leased.
- greyface- 3y ago
  They were DC<->DC fiber links, carrying unencrypted Stubby RPC traffic. Internal is an accurate descriptor.
  - ethbr1 3y ago
    Suffice to say internal to Google's network architecture at the time, subsequently remediated with encryption, but physically external to Google DCs. It did raise a fascinating question about where the physical tap was and how the take was routed back. You do the tap at a hub, and you have the egress connectivity, but you're one unexpected employee away from discovery. You do the tap in the middle of nowhere, and how do you get the data stream back? I'd guess they went rural and just leased physically adjacent dark fiber to route out on.
    - pests 3y ago
      The return routes are most likely in the same run but just a different strand. I think this is the way underwater cables are tapped - no need for a completely new run back.
    - cavisne 3y ago
      Level 3 basically admitted they did it for them, so it would have been at a hub.
Tiberium 3y ago
That Google incident sounds interesting, do you have links to the technical explanations? From a quick search all I could find are news reports.
- formerly_proven 3y ago
  It's from the OG PRISM slides. Previously Google's internal production network didn't use encryption, SSL/TLS was terminated at the perimeter. So the NSA simply tapped their dark fiber between data centers.
supriyo-biswas 3y ago
But it becomes significantly easier if Cloudflare performs this cooperation; most ISPs are required to maintain such data as well.

ignoramous 3y ago

Except, Cloudflare already proxies 10% or more of all HTTP traffic (has plaintext access to most of it). If the authorities wanted to DPI away, there's already more to look at even without these VPN offerings. > From a purely technical perspective this seems to be a slightly worse version of Apple Private Relay. Private Relay is a well thought out design. Microsoft Edge Secure Network is merely a proxy because it is built for a different threat model: https://archive.is/pNnW5 https://archive.is/pNnW5

supriyo-biswas 3y ago
DPI at ISPs or Cloudflare isn't really what I'm concerned about; it's the impending destruction of the VPN service model by mandating censorship and logging.
- adventured 3y ago
  I'll be curious to see what tactics they (the political block in the West that's acting in quasi concert to enhance domestic espionage capabilities) attempt to use to accomplish it in the US given the enshrined protections we have that Europeans typically lack, which in theory should make it very difficult to censor VPNs here. The logging requirement aspect may end up being the part they can more readily get through in the US (one that will survive freedom of speech etc challenges).
- ignoramous 3y ago
  VPNs aren't the solution to surveillance and censorship. Tor-style networks are better suited. Some of which are already in the process of standardization by the IETF. > DPI at ISPs or Cloudflare isn't really what I'm concerned about Well, ~50% content of the comment I replied to comprised of these "non-concerns".
  - methou 3y ago
    The usability of Tor is very PGP like. Personally I never seen one or introduced to one vibrant / healthy society. Also it's trend since a long time ago, people don't really mention about Tor sites on the clear net. (Ye, I know about the hiddenwiki)

Dah00n 3y ago

Seems to me NSA likely already have internal access at CF as they do at Apple, looking at what Snowden released + time passed, so it is a likely next step.

gruez 3y ago

>However, in this case, and because of the ClientHello permutation in Chromium based browsers[1] such as Edge, Cloudflare gets a high-entropy identifier + IP address, which, along with SNI header inspection, could be theoretically used to identify individual users. As per your own source, a different permutation is used per connection, so it's unclear how it would help to "identify individual users".

supriyo-biswas 3y ago
I stand corrected wrt the operators; while the diagram mentions that there is an ingress and egress component, it is not clear as to whether two different entities operate them. I've updated my comments to reflect that. Iff they're the same operator, I assume there'd be a TLS connection between Microsoft Edge Secure and the Edge browser, and that'd be a long-lived session because of the nature of proxying traffic, which means there's a static identifier. Even if it wasn't, IP addresses may themselves be considered as sensitive enough for such identification.

tomwheeler 3y ago

> I really hate to be that guy, but I'm afraid that Cloudflare partnering with every browser to offer a VPN is just going to draw the attention of authorities On the bright side, maybe they'll protect it with their "One more step...please wait while we verify your browser" system, which has such a high false positive rate (in my experience) that few people could actually access it.

Arnavion 3y ago
That only blocks people with secure, locked-down browsers, so it won't be a problem for Edge users.

kgeist 3y ago

>There is already precedent for this happening in Russia; in that incident every VPN pulled out of the country. However if everyone enforces it, it's gonna be hard. Not only that, ISPs now close all connections which look like VPN traffic. I used to have my own OpenVPN server as a window to the free world and now it doesn't work... I wish there was some kind of open standard which doesn't leave a very obvious signature which is easy to detect by ISPs. I don't know if HTTP CONNECT can be hidden from ISPs? I guess I'm going to try Edge after all.

supriyo-biswas 3y ago
You could look into Shadowsocks, V2Ray and similar. It's also been a while I've read about these topics, so I'm not sure if Russia also does entropy analysis and fingerprinting differences to block these protocols either. You may like reading about the new TSPU system in Russia [1], and discussing your issues on [2]. [1] https://censoredplanet.org/tspu https://censoredplanet.org/tspu [2] http://ntc.party http://ntc.party
_lvbh 3y ago
The Chinese have been fighting this war for a while. The results are in favor of users: see Trojan-gfw, Xray-core, v2ray
gerdesj 3y ago
Try switching to 443/tcp or try a high port like 10000/udp. The first might look rather like streaming over https and the second like an encrypted RTP stream in a mad SIP n RTP session. You can also co-exist OpenVPN on 443/tcp with a "real" web server. The usual use case for that is getting more value out of a single IP address. Put your pony fan club website up or an Ubuntu default webpage. Another possibility is to use port knocking to open ports before the OVPN connects.
- gerdesj 3y ago
  ... and now I come to think of it: PPTP is generally believed to be broken so it might be "allowed" because it will be assumed that grabbing and storing the stream will be sufficient for later analysis. Then you put a OpenVPN inside the PPTP tunnel with proper, modern encryption. ... 53/tcp or udp might be worth trying too. 123/udp - ntp, 25/tcp - email! Basically try being weird - it may well work!

NicoJuicy 3y ago

What is Russia going to do? Block 30% of the web and 90% of the most important sites?

Raymonf 3y ago
Maybe eventually? https://www.scientificamerican.com/article/russia-is-trying-to-leave-the-internet-and-build-its-own/ https://www.scientificamerican.com/article/russia-is-trying-...
KirillPanov 3y ago
China does.
- NicoJuicy 3y ago
  China isn't blocking cloudflare, cloudflare has a separate network for China https://www.cloudflare.com/application-services/products/china-network/ https://www.cloudflare.com/application-services/products/chi...
  - supriyo-biswas 3y ago
    China is blocking the RoW Cloudflare since websites and web hosting services need to be officially certified by the government by way of an ICP recordal. Many CDNs set up a China specific network which customers can use it subject to presenting their recordal; that’s what Cloudflare China is.
    - NicoJuicy 3y ago
      So... Not blocking cloudflare China?

neom 3y ago

You should do some research on Matthew Prince, his background is very interesting. He's pretty much the only tech CEO who I could say "yeah, I trust him". I'm not saying your concern isn't valid, it's a great point. Only that if anyone was going to run a company like Cloudflare, we're lucky it's Matthew, he's not a dumbass.

Minor49er 3y ago
He runs the largest man-in-the-middle service online. I wouldn't put an ounce of trust into him
austhrow743 3y ago
I read his wiki. Didn’t see anything of the hates three letter agencies or the American government variety. I did see this: > In 2008, the Department of Homeland Security (DHS) contacted Unspam Technologies, asking, "Do you have any idea how valuable the data you have is?" The DHS' email served as the impetus for Cloudflare, a technology company Prince co-founded with Holloway and fellow Harvard Business School graduate Michelle Zatlyn the following year. Which sounds like the opposite of what we would want. Cloudflare being started because a three letter agency told him that harvesting internet data is valuable. Unless his take away was “they do that too? Better try to stop it!” Is there something else you’re referring to?
jjav 3y ago
> Only that if anyone was going to run a company like Cloudflare, we're lucky it's Matthew, he's not a dumbass. This may be totally true, but it's extremely important to understand that it does not matter. As a US-based company Cloudflare is subject to NSLs (https://en.wikipedia.org/wiki/National_security_letter https://en.wikipedia.org/wiki/National_security_letter) which will force them to reveal all traffic and never talk about it. There's nothing they can do to resist that, regardless of founder personality. Combine this with the fact that Cloudflare terminates TLS traffic, so it's all in the clear within their infrastructure. It would be difficult to think of a more juicy target for intelligence agencies waving NSLs. It'll all be classified so we'll never know (unless some future Snowden tell us). But it is logical and wise to assume all traffic passing through Cloudflare is siphoned off in cleartext to the TLAs.