4 ms·
Recently, many European countries have started using Cloudflare’s anti-DDoS protection for government services, which is fine since it can be done securely with
by dtquad 2y ago
Recently, many European countries have started using Cloudflare’s anti-DDoS protection for government services, which is fine since it can be done securely with end-to-end encryption in a zero-trust model.
However, these countries are now increasingly using Cloudflare Workers without realizing that this creates total uncertainty about where their data and business logic might end up—including potentially adversarial countries like Russia and China.
Data in transit and data at rest can be encrypted. But Clouflare Workers is neither. It's data being processed in-memory where it will be unencrypted.
- Avamander 2y ago> ... Cloudflare’s anti-DDoS protection for government services, which is fine since it can be done securely with end-to-end encryption in a zero-trust model. Unless it's below L7/HTTP, the possibility of doing it securely is very questionable. Up until very recently it was very trivial to conduct "domain fronting" of sorts but with colocations in hostile locations. So Chinese or Russian servers decrypting your TLS traffic no questions asked, and that was with their premium (DLS) offerings. I suspect that if you're in a hostile country where CF announces their prefixes locally, it's still doable. Unfortunately that's a bit more difficult to test than it was before.