7 ms·
Maybe if we weren't letting a third party sign arbitrary certificates for arbitrary domains they wouldn't be reading our passwords. People don't realise CloudF
by anacrolix 2y ago
Maybe if we weren't letting a third party sign arbitrary certificates for arbitrary domains they wouldn't be reading our passwords.
People don't realise CloudFlare is a MitM-as-a-Service.
- dizhn 2y agoWhat do you mean? Is cloudflare causing 3rd parties to read our passwords?
- doublerabbit 2y agoCould. A HTTP post request along the wire is unencrypted. I'm talking about a submit button not HTTPS as that just encrypts the connection session and not the data sent from say a form. If you're using or utilising CF for something where the data is being posted to an API unless you have client side encryption anything receiving that data will be received in plain text. Someone only needs to compromise the service worker and syphon the data.
- atmanactive 2y agoI highly doubt that this is true. HTTPS POST data is encrypted just like any other HTTPS data. But, if one is using CloudFlare or any other proxy, by nature, that data needs to be decrypted and then encrypted again on it's way to the destination server. So, yes, of course, each and every proxy can see the data. And, no, HTTPS POST data can't be snooped over the wire otherwise.
- doublerabbit 2y agoWhat's not true? I may of mumbled my post. The data from the form, HTTPS POST data is not encrypted. It's plain text encapsulated in a secure socket. Setup a PHP page with a form and capture the $_POST. All will return in plaintext. POST is data is sent in headers which yes are encrypted by SSL but the servers receiving will receive it in plain text. By using third party you lose full control of the data flow encrypted or not. All it takes is one weak link in the chain and your data is screwed. You're relying on the 3rd party infrastructure not being exploited.
- anacrolix 2y agoExactly this. If CloudFlare, any "relay" were compromised, all traffic through that would be compromised. That's everything. All your bank details, full access, it's all right there. The selling point of SSL is nobody can read what you do between you and the final destination, except when the developers of that destination enlist CloudFlare who have a root certificate that allows them to intercept everything whether you realise or not.
- tomesch1982 2y agoWhat's more problematic is that Cloudflare is obviously reading and storing and analyzing passwords. So every service that uses Cloudflare on a login page is compromised. I bet that there are several Excel files with all scraped passwords circulating within Cloudflare.
- jgrahamc 2y agoThat's complete nonsense. We are not storing passwords and passing around Excel spreadsheets of them! We've worked on this stuff for years (this stuff being how to warn users about compromised passwords). You can go back to 2018 with our work with Troy Hunt on Pwned Passwords (https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymity/ https://blog.cloudflare.com/validating-leaked-passwords-with...), or our 2021 work on a privacy-preserving way of checking a password against a list of known compromised passwords (https://blog.cloudflare.com/privacy-preserving-compromised-credential-checking/ https://blog.cloudflare.com/privacy-preserving-compromised-c...).
- anacrolix 2y agoCloudFlare is the 3rd party. Try implementing what CloudFlare does yourself. You will very quickly realise how it works. It's actually pretty crazy.
- deleted 2y ago[deleted]