3 ms·
Cloudflare is essentially a massive mitm proxy. If you manage to pwn a key, you have access to traffic. I'm sure they're better than this than me, but ipxe &
by ownagefool 3y ago
Cloudflare is essentially a massive mitm proxy. If you manage to pwn a key, you have access to traffic.
I'm sure they're better than this than me, but ipxe & tftp are plain text, so it wouldn't be shocking if something in the bootstrap process was plaintext.
At the very least you need to tell the server what to trust.
- meowface 3y ago>If you manage to pwn a key, you have access to traffic. That's why I mentioned "Full (Strict)" SSL. If you configure this in Cloudflare then the entire user <-> Cloudflare <-> origin path is encrypted and attackers can't snoop on the plaintext even if they have access. They'll get some metadata, but every ISP in the world gets that at all times anyway.
- is39 3y agoWhile both client and origin network connections are encrypted with "Full (Strict)" SSL mode, Cloudflare proxy in the middle decrypts client traffic and then encrypts it towards the server (and vice versa). It does have access to plaintext, which is how various mitigations work. So it's indeed MITM proxy, by design.
- meowface 3y agoAh, yeah, you're right.