13 ms·

Cloudflare has access to everyone's cleartext? I was unaware of this. NSA must love that

by kaimac 3y ago

strombofulous 3y ago
Yes, although it requires configuration https://developers.cloudflare.com/ssl/get-started/ https://developers.cloudflare.com/ssl/get-started/
- arch-choot 3y ago
  I'm pretty sure the default is they can see all the cleartext, since their product is based on TLS interception, for example to evaluate page rules. This is also how they insert extra headers in both the request and response.
- creatonez 3y ago
  When you add a DNS rule, it's configured as proxied by default. Here is what it looks like in the UI: https://i.imgur.com/TO2Tfk3.png https://i.imgur.com/TO2Tfk3.png https://i.imgur.com/jVW5db4.png https://i.imgur.com/jVW5db4.png
- midasuni 3y ago
  If cloudflare have thr certificate’s private key and are advertising the A record they have access to everything you send, from emails to credit card numbers.
ytch 3y ago
It's a TLS termination proxy that decrypt and re-encrypt your TLS packet. Technically Cloudflare can read anything unless you add your own crypt layer on top of TLS.
deleted 3y ago
[deleted]
judge2020 3y ago
Same for Akamai, Cloudfront, Fastly, etc. Pretty much every business that wants to offload DDOS protection, caching,and some level of frontline security uses a proxying CDN. An alternative is to keep all of your CDN assets on a CDN bucket on its own hostname, with your main secret-containing business apps on your own servers, but it costs a lot to manage this level of separation and the payoff is only protection against the theoretical attack of "NSA can't attack our users/spy on them". If the NSA ever did do this on a large enough scale or to target a particularly notable person, it's very unlikely it would be kept a secret for long, and the end-business that used Cloudflare et al. wouldn't be implicated whatsoever since every business uses one of the big CDN providers.
- bejk22 3y ago
  That makes using https instead of http a lot less relevant.
  - judge2020 3y ago
    https is important for preventing spying by anyone else in between you and the server. ISPs, coffee shop owners, schools, etc used to spy on http traffic to see what people were doing/searching for, and ISPs like xFinity injected code into non-https pages to show "important messages" to users, e.g. going over your bandwidth limit[0]. The only weak link now is Cloudflare, which is still "less secure than a direct connection" (with respect to government spying, bugs[0], hackers, etc) but the threat level is drastically reduced. 0: https://blog.ryankearney.com/2013/01/comcast-caught-intercepting-and-altering-your-web-traffic/ https://blog.ryankearney.com/2013/01/comcast-caught-intercep... 1: https://news.ycombinator.com/item?id=13766339 https://news.ycombinator.com/item?id=13766339
    - EasyMark 3y ago
      I too inject porn images, inverted images, backwards texst, etc in http back in the day for people piggybacking (without permission) off my wifi.
    - xk_id 3y ago
stingraycharles 3y ago
It’s a CDN that caches content and it’s able to inject “are you human?” verification pages, it can rewrite content on demand (e.g. serve optimized images / html / JavaScript). It seems obvious to me that they have access and ability to modify all cleartext content in-flight.
mlindner 3y ago
Yes that's how Cloudfare works. The TLS certificate for basically any website using Cloudflare "ends" at Cloudflare's servers. It's then either forwarded on to the actual servers in cleartext or re-encrypted with an internal company certificate (maybe signed internally as well) to pass the connection on to the actual servers. It was the easy way many companies who didn't have the expertise to do their own certificate management moved from the http world to the https world. They just handed it off to cloudflare and kept their servers running http. F5 Networks, my former employer, sells something similar, but it's a box (or virtual appliance) you put in your own data centers somewhere that dead-ends the connection instead.
jpc0 3y ago
Btw the same is possible for phishing sites. It's entirely possible to have a proper SSL connection to a bogus hostname, that is showing the correct website and even interacts correctly. Bogus MITM decrypts the traffic, logs it, then forwards the traffic once again encrypted to the destination server. Then does the reverse for the resonse. "Look for the padlock" is only useful if the actual hostname is correct in the browser. If I hosted news.ycombnator.com using this and you didn't notice that I could be proxying just like that. It's possible cloudflare has protections against this in place but doesn't every website on earth? Look at the damned hostname people.
cheekibreeki2 3y ago
And every big company can decrypt your tls web traffic with their special CA keys.
- fragmede 3y ago
  Can you explain what you mean a bit more? My connection to eg my bank isn't decryptable by anybody but me and my bank (and their CDN which is serving their certificate). That is, eg, Verisign has root CA keys to sign the cert, and they could give me a cert that says they're my bank and I could make a new connection that they could decrypt, but the original connection to my bank can't be decrypted by their keys.

Cloudflare has access to everyone's cleartext? I was unaware of this. NSA must love that

by kaimac 3y ago

Cloudflare has access to everyone's cleartext? I was unaware of this. NSA must love that

Yes, although it requires configuration https://developers.cloudflare.com/ssl/get-started/ https://developers.cloudflare.com/ssl/get-started/

arch-choot 3y ago
I'm pretty sure the default is they can see all the cleartext, since their product is based on TLS interception, for example to evaluate page rules. This is also how they insert extra headers in both the request and response.
creatonez 3y ago
When you add a DNS rule, it's configured as proxied by default. Here is what it looks like in the UI: https://i.imgur.com/TO2Tfk3.png https://i.imgur.com/TO2Tfk3.png https://i.imgur.com/jVW5db4.png https://i.imgur.com/jVW5db4.png
midasuni 3y ago
If cloudflare have thr certificate’s private key and are advertising the A record they have access to everything you send, from emails to credit card numbers.

ytch 3y ago

It's a TLS termination proxy that decrypt and re-encrypt your TLS packet. Technically Cloudflare can read anything unless you add your own crypt layer on top of TLS.

deleted 3y ago

[deleted]

judge2020 3y ago

Same for Akamai, Cloudfront, Fastly, etc. Pretty much every business that wants to offload DDOS protection, caching,and some level of frontline security uses a proxying CDN. An alternative is to keep all of your CDN assets on a CDN bucket on its own hostname, with your main secret-containing business apps on your own servers, but it costs a lot to manage this level of separation and the payoff is only protection against the theoretical attack of "NSA can't attack our users/spy on them". If the NSA ever did do this on a large enough scale or to target a particularly notable person, it's very unlikely it would be kept a secret for long, and the end-business that used Cloudflare et al. wouldn't be implicated whatsoever since every business uses one of the big CDN providers.

bejk22 3y ago
That makes using https instead of http a lot less relevant.
- judge2020 3y ago
  https is important for preventing spying by anyone else in between you and the server. ISPs, coffee shop owners, schools, etc used to spy on http traffic to see what people were doing/searching for, and ISPs like xFinity injected code into non-https pages to show "important messages" to users, e.g. going over your bandwidth limit[0]. The only weak link now is Cloudflare, which is still "less secure than a direct connection" (with respect to government spying, bugs[0], hackers, etc) but the threat level is drastically reduced. 0: https://blog.ryankearney.com/2013/01/comcast-caught-intercepting-and-altering-your-web-traffic/ https://blog.ryankearney.com/2013/01/comcast-caught-intercep... 1: https://news.ycombinator.com/item?id=13766339 https://news.ycombinator.com/item?id=13766339
  - EasyMark 3y ago
    I too inject porn images, inverted images, backwards texst, etc in http back in the day for people piggybacking (without permission) off my wifi.
  - xk_id 3y ago

stingraycharles 3y ago

It’s a CDN that caches content and it’s able to inject “are you human?” verification pages, it can rewrite content on demand (e.g. serve optimized images / html / JavaScript). It seems obvious to me that they have access and ability to modify all cleartext content in-flight.

mlindner 3y ago

Yes that's how Cloudfare works. The TLS certificate for basically any website using Cloudflare "ends" at Cloudflare's servers. It's then either forwarded on to the actual servers in cleartext or re-encrypted with an internal company certificate (maybe signed internally as well) to pass the connection on to the actual servers. It was the easy way many companies who didn't have the expertise to do their own certificate management moved from the http world to the https world. They just handed it off to cloudflare and kept their servers running http. F5 Networks, my former employer, sells something similar, but it's a box (or virtual appliance) you put in your own data centers somewhere that dead-ends the connection instead.

jpc0 3y ago

Btw the same is possible for phishing sites. It's entirely possible to have a proper SSL connection to a bogus hostname, that is showing the correct website and even interacts correctly. Bogus MITM decrypts the traffic, logs it, then forwards the traffic once again encrypted to the destination server. Then does the reverse for the resonse. "Look for the padlock" is only useful if the actual hostname is correct in the browser. If I hosted news.ycombnator.com using this and you didn't notice that I could be proxying just like that. It's possible cloudflare has protections against this in place but doesn't every website on earth? Look at the damned hostname people.

cheekibreeki2 3y ago

And every big company can decrypt your tls web traffic with their special CA keys.

fragmede 3y ago
Can you explain what you mean a bit more? My connection to eg my bank isn't decryptable by anybody but me and my bank (and their CDN which is serving their certificate). That is, eg, Verisign has root CA keys to sign the cert, and they could give me a cert that says they're my bank and I could make a new connection that they could decrypt, but the original connection to my bank can't be decrypted by their keys.