4 ms·

It is more secure (though not end-to-end secure, of course) from the PoV of most threat models because the monitoring most are most concerned about is at their

It is more secure (though not end-to-end secure, of course) from the PoV of most threat models because the monitoring most are most concerned about is at their side of the connection (“local infra (often wireless) -> through ISP -> …” or “local -> through ISP -> through state/org level monitoring -> …”). Tracking you by monitoring the network traffic between CF (or other connection aggregator) and the origins is possible, but usually significantly more effort. Those with reason to be concerned about true end-to-end encryption will know that seeing any CF artefacts means they need to investigate to know if they are getting e2ee or just end-to-proxy.

londons_explore 11d ago
At a minimum I'd like cloudflare to mark such traffic in some way, and browsers to put a little cross through the "Https" indicator to show the traffic is passing unencrypted across the internet.
- dspillett 10d ago
  That is not a small “minimum”. There are places in the certificate format that a new flag can go, but then all browsers and apps that perform https requests need to be altered to display this in a manner that is: • consistent • not overly serious, so users who end up trained to ignore this new signal don't automatically ignore more significant warnings • (and this is the fun part) communicate this new semaphore signal to the general public without confusing them… To head off one cynical question: “Why worry about the general public when they wouldn't care anyway and just click through warnings with wreckless abandon already?” - if not the general public then who would this be for? Those who might need to care are already checking if their data is going through CF and so might not to under true E2EE.
  - kawsper 10d ago
    They can just add an http header that browsers and browser plugins can listen for, they already add `cf-cache-status: HIT`, so they could add this too: cf-http-endpoint: 1 or if you want it to match their own terminology[0], it could be: cf-encryption-mode: off/flexible/full/full-strict/strict [0]: https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/ https://developers.cloudflare.com/ssl/origin-configuration/s...

londons_explore 11d ago

At a minimum I'd like cloudflare to mark such traffic in some way, and browsers to put a little cross through the "Https" indicator to show the traffic is passing unencrypted across the internet.

dspillett 10d ago
That is not a small “minimum”. There are places in the certificate format that a new flag can go, but then all browsers and apps that perform https requests need to be altered to display this in a manner that is: • consistent • not overly serious, so users who end up trained to ignore this new signal don't automatically ignore more significant warnings • (and this is the fun part) communicate this new semaphore signal to the general public without confusing them… To head off one cynical question: “Why worry about the general public when they wouldn't care anyway and just click through warnings with wreckless abandon already?” - if not the general public then who would this be for? Those who might need to care are already checking if their data is going through CF and so might not to under true E2EE.
- kawsper 10d ago
  They can just add an http header that browsers and browser plugins can listen for, they already add `cf-cache-status: HIT`, so they could add this too: cf-http-endpoint: 1 or if you want it to match their own terminology[0], it could be: cf-encryption-mode: off/flexible/full/full-strict/strict [0]: https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/ https://developers.cloudflare.com/ssl/origin-configuration/s...