[HN Gopher] Cloudflare is now powering Microsoft Edge Secure Net...
___________________________________________________________________
Cloudflare is now powering Microsoft Edge Secure Network
Author : jgrahamc
Score : 132 points
Date : 2023-09-28 13:28 UTC (9 hours ago)
(HTM) web link (blog.cloudflare.com)
(TXT) w3m dump (blog.cloudflare.com)
| gjsman-1000 wrote:
| So, Microsoft Edge now comes with an equivalent to Apple's
| Private Relay, just without Apple as a middleman between
| Cloudflare and Fastly.
|
| Neat. On the other hand... I have to hand it to Cloudflare,
| they've done a great job turning themselves into the internet's
| second backbone. (AWS might as well be the third backbone.)
|
| It seems that decentralized systems always centralize over time
| when it comes to mindshare, and _really_ don't like
| decentralizing. Like, once the network effects begin even
| slightly, it becomes irreversible quickly. Linux is still not
| beating Windows and Mac. Mastodon's numbers are still tiny
| compared to Twitter. Bitcoin hasn't really hurt banks. The
| internet started out fairly decentralized, look at it now.
|
| I've come to the conclusion that people just do not like
| decentralized anything, period. Which is unfortunate.
| pocketarc wrote:
| > always centralize over time when it comes to mindshare
|
| Yeah, you're absolutely right. Companies grow, and people talk
| about them, and get other people to try them, and they grow
| more, and more, until it becomes the "default" option that
| everyone knows, and they become entrenched by sheer power of
| their mindshare.
|
| Especially in a global world where these brands become larger
| than life. There are brands with more global recognition and
| soft power than most countries out there.
|
| Most people go with the defaults. That goes for software as
| much as companies. It doesn't matter how many decentralised
| options you have, because mindshare is what matters. Being the
| default in people's minds is what matters.
|
| You need hosting? AWS. CDN? CloudFlare. Git? GitHub. Video?
| YouTube. And so on. There -are- options. But people aren't
| going to bother, when they can just... go with the default.
|
| It's not about people not liking decentralisation, it's just
| much more mental effort to research and explore options when
| you can just go with the default.
| mdasen wrote:
| > So, Microsoft Edge now comes with an equivalent to Apple's
| Private Relay
|
| It's only 5GB for free. Microsoft doesn't have a paid option
| yet so we'll have to wait and see what that costs.
| Am4TIfIsER0ppos wrote:
| So cloudflare can now MITM all the other servers that don't agree
| to use their services?
| acheong08 wrote:
| VPN does not override TLS unless you install their root
| certificates or something
| candiddevmike wrote:
| Microsoft acquiring Cloudflare would be a very interesting
| acquisition, probably similar to them acquiring GitHub.
| tempodox wrote:
| So "Microsoft" and "Secure" in the same sentence is actually a
| thing?
| betaby wrote:
| Endgame I suppose is to forbid IP-IP communications and allow
| only gated platform to gated platform communications.
| audessuscest wrote:
| CF is really on fire recently https://blog.cloudflare.com/
| edwinbalani wrote:
| Their posts in the last few days are all tagged "Birthday
| Week", so I guess their PR office has been queueing them all up
| for a little while.
| 015a wrote:
| Traditionally at Cloudflare, Birthday Week is the "release
| new products" week; they're not writing announcements for
| products that they've already shipped, but rather Birthday
| Week is the deadline every year for a ton of big new products
| that are being built.
| mcbrienollie wrote:
| You cannot "secure" the internet by centralizing all the traffic
| into a specific place. Internet meant to be decentralized by its
| own nature. Cloudflare is just one of the companies which is
| trying to monopolize the whole industry by the partnerships.
| focusedone wrote:
| I don't feel less spied on by passing all of my traffic through
| anything related to Microsoft.
| [deleted]
| supriyo-biswas wrote:
| I really hate to be that guy, but I'm afraid that Cloudflare
| partnering with every browser to offer a VPN is just going to
| draw the attention of authorities, who would force them to
| install their censorship policies and force flow logging on all
| proxying services of this kind, effectively killing the purpose
| of such services.
|
| There is already precedent for this happening in Russia; in that
| incident every VPN pulled out of the country. However if everyone
| enforces it, it's gonna be hard.
|
| --
|
| From a purely technical perspective this seems to equivalent to
| Apple Private Relay _iff_ the operator for the ingress and egress
| are two different endpoints, which it is not clear from the
| presentation.
|
| In the case of APR Apple has their own servers
| (mask-h2.icloud.com) that accepts connections and obscures the IP
| <-> website mapping for their exit relay providers, who are
| Cloudflare, Akamai and Fastly at the moment.
|
| If they are the same operator, because of the ClientHello
| permutation in Chromium based browsers[1] such as Edge,
| Cloudflare gets a high-entropy identifier + IP address, which,
| along with SNI header inspection, could be theoretically used to
| identify individual users.
|
| [1] https://www.fastly.com/blog/a-first-look-at-chromes-tls-
| clie...
| neom wrote:
| You should do some research on Matthew Prince, his background
| is very interesting. He's pretty much the only tech CEO who I
| could say "yeah, I trust him".
|
| I'm not saying your concern isn't valid, it's a great point.
| Only that if anyone was going to run a company like Cloudflare,
| we're lucky it's Matthew, he's not a dumbass.
| Minor49er wrote:
| He runs the largest man-in-the-middle service online. I
| wouldn't put an ounce of trust into him
| austhrow743 wrote:
| I read his wiki. Didn't see anything of the hates three
| letter agencies or the American government variety. I did see
| this:
|
| > In 2008, the Department of Homeland Security (DHS)
| contacted Unspam Technologies, asking, "Do you have any idea
| how valuable the data you have is?" The DHS' email served as
| the impetus for Cloudflare, a technology company Prince co-
| founded with Holloway and fellow Harvard Business School
| graduate Michelle Zatlyn the following year.
|
| Which sounds like the opposite of what we would want.
| Cloudflare being started because a three letter agency told
| him that harvesting internet data is valuable. Unless his
| take away was "they do that too? Better try to stop it!"
|
| Is there something else you're referring to?
| kgeist wrote:
| >There is already precedent for this happening in Russia; in
| that incident every VPN pulled out of the country. However if
| everyone enforces it, it's gonna be hard.
|
| Not only that, ISPs now close all connections which look like
| VPN traffic. I used to have my own OpenVPN server as a window
| to the free world and now it doesn't work... I wish there was
| some kind of open standard which doesn't leave a very obvious
| signature which is easy to detect by ISPs. I don't know if HTTP
| CONNECT can be hidden from ISPs? I guess I'm going to try Edge
| after all.
| supriyo-biswas wrote:
| You could look into Shadowsocks, V2Ray and similar.
|
| It's also been a while I've read about these topics, so I'm
| not sure if Russia also does entropy analysis and
| fingerprinting differences to block these protocols either.
|
| You may like reading about the new TSPU system in Russia [1],
| and discussing your issues on [2].
|
| [1] https://censoredplanet.org/tspu
|
| [2] http://ntc.party
| gerdesj wrote:
| Try switching to 443/tcp or try a high port like 10000/udp.
| The first might look rather like streaming over https and the
| second like an encrypted RTP stream in a mad SIP n RTP
| session.
|
| You can also co-exist OpenVPN on 443/tcp with a "real" web
| server. The usual use case for that is getting more value out
| of a single IP address. Put your pony fan club website up or
| an Ubuntu default webpage.
|
| Another possibility is to use port knocking to open ports
| before the OVPN connects.
| gerdesj wrote:
| ... and now I come to think of it:
|
| PPTP is generally believed to be broken so it might be
| "allowed" because it will be assumed that grabbing and
| storing the stream will be sufficient for later analysis.
| Then you put a OpenVPN inside the PPTP tunnel with proper,
| modern encryption.
|
| ... 53/tcp or udp might be worth trying too. 123/udp - ntp,
| 25/tcp - email! Basically try being weird - it may well
| work!
| acheong08 wrote:
| The Chinese have been fighting this war for a while. The
| results are in favor of users: see Trojan-gfw, Xray-core,
| v2ray
| ignoramous wrote:
| Except, Cloudflare already proxies 10% or more of all HTTP
| traffic (has _plaintext_ access to most of it). If the
| authorities wanted to DPI away, there 's already more to look
| at even without these VPN offerings.
|
| > _From a purely technical perspective this seems to be a
| slightly worse version of Apple Private Relay._
|
| _Private Relay_ is a well thought out design. _Microsoft Edge
| Secure Network_ is merely a _proxy_ because it is built for a
| different threat model: https://archive.is/pNnW5
| supriyo-biswas wrote:
| DPI at ISPs or Cloudflare isn't really what I'm concerned
| about; it's the impending destruction of the VPN service
| model by mandating censorship and logging.
| ignoramous wrote:
| VPNs aren't _the_ solution to surveillance and censorship.
| Tor-style networks are better suited. Some of which are
| already in the process of standardization by the IETF.
|
| > _DPI at ISPs or Cloudflare isn 't really what I'm
| concerned about_
|
| Well, ~50% content of the comment I replied to comprised of
| these "non-concerns".
| adventured wrote:
| I'll be curious to see what tactics they (the political
| block in the West that's acting in quasi concert to enhance
| domestic espionage capabilities) attempt to use to
| accomplish it in the US given the enshrined protections we
| have that Europeans typically lack, which in theory should
| make it very difficult to censor VPNs here. The logging
| requirement aspect may end up being the part they can more
| readily get through in the US (one that will survive
| freedom of speech etc challenges).
| NicoJuicy wrote:
| What is Russia going to do? Block 30% of the web and 90% of the
| most important sites?
| Dah00n wrote:
| Seems to me NSA likely already have internal access at CF as
| they do at Apple, looking at what Snowden released + time
| passed, so it is a likely next step.
| greyface- wrote:
| > authorities [...] would force them to install [...] flow
| logging
|
| This doesn't necessarily require Cloudflare's cooperation.
| Remember when the NSA tapped Google's internal network without
| their knowledge? SSL added and removed here :-)
| lokar wrote:
| Not really internal. Long distance fiber lines between sites,
| mostly leased.
| greyface- wrote:
| They were DC<->DC fiber links, carrying unencrypted Stubby
| RPC traffic. Internal is an accurate descriptor.
| ethbr1 wrote:
| Suffice to say internal to Google's network architecture
| at the time, subsequently remediated with encryption, but
| physically external to Google DCs.
|
| It did raise a fascinating question about where the
| physical tap was and how the take was routed back.
|
| You do the tap at a hub, and you have the egress
| connectivity, but you're one unexpected employee away
| from discovery.
|
| You do the tap in the middle of nowhere, and how do you
| get the data stream back?
|
| I'd guess they went rural and just leased physically
| adjacent dark fiber to route out on.
| pests wrote:
| The return routes are most likely in the same run but
| just a different strand. I think this is the way
| underwater cables are tapped - no need for a completely
| new run back.
| Tiberium wrote:
| That Google incident sounds interesting, do you have links to
| the technical explanations? From a quick search all I could
| find are news reports.
| formerly_proven wrote:
| It's from the OG PRISM slides. Previously Google's internal
| production network didn't use encryption, SSL/TLS was
| terminated at the perimeter. So the NSA simply tapped their
| dark fiber between data centers.
| supriyo-biswas wrote:
| But it becomes significantly easier if Cloudflare performs
| this cooperation; most ISPs are required to maintain such
| data as well.
| tomwheeler wrote:
| > I really hate to be that guy, but I'm afraid that Cloudflare
| partnering with every browser to offer a VPN is just going to
| draw the attention of authorities
|
| On the bright side, maybe they'll protect it with their "One
| more step...please wait while we verify your browser" system,
| which has such a high false positive rate (in my experience)
| that few people could actually access it.
| Arnavion wrote:
| That only blocks people with secure, locked-down browsers, so
| it won't be a problem for Edge users.
| gruez wrote:
| >However, in this case, and because of the ClientHello
| permutation in Chromium based browsers[1] such as Edge,
| Cloudflare gets a high-entropy identifier + IP address, which,
| along with SNI header inspection, could be theoretically used
| to identify individual users.
|
| As per your own source, a different permutation is used per
| connection, so it's unclear how it would help to "identify
| individual users".
| supriyo-biswas wrote:
| I stand corrected wrt the operators; while the diagram
| mentions that there is an ingress and egress component, it is
| not clear as to whether two different entities operate them.
| I've updated my comments to reflect that.
|
| Iff they're the same operator, I assume there'd be a TLS
| connection between Microsoft Edge Secure and the Edge
| browser, and that'd be a long-lived session because of the
| nature of proxying traffic, which means there's a static
| identifier. Even if it wasn't, IP addresses may themselves be
| considered as sensitive enough for such identification.
| pogue wrote:
| I didn't read the entire article, but it sounds like it's just a
| very old school port 80 proxy type "VPN" not dissimilar to
| Opera's VPN.
| Arnavion wrote:
| Yes, all the proxy companies of the 2000s realized that the
| "Private" in "Virtual Private Network" makes for good
| marketing, so they all rebranded themselves as VPNs, even
| though they have nothing to do with actual VPNs other than
| using OpenVPN / Wireguard for their proxy transport.
| thedaly wrote:
| Interesting. I imagine it would be difficult to effectively block
| cloudflare VPN IPs without also blocking content from a lot of
| other sites.
| johnklos wrote:
| That's exactly their game. They want to be in a position where
| they can host whomever they like, no matter how spammy / scammy
| / attacky, and there isn't anything anyone can do about it
| without lots of collateral damage.
| elashri wrote:
| Maybe a little bit off topic. But Edge secure network is maybe
| the only way in egypt to have semi stable VPN. Egypt aggressively
| block VPN on protocol level and using combined arsenal of
| blocking capabilities to do that. Doing handshaking ia maybe more
| dangerous than visiting ISIS propaganda website in the US (when
| this was a thing). The only other reliable way to do it is via
| ssh tunneling and Tor private bridges. But these two have their
| own problems. I doubt that they would ban Microsoft Edge network
| specially that to do that now a lot of things in windows and
| cloudflare network will stop working which is not something that
| can be done.
|
| Egyptian ISPs used to hijack DNS for all reasons (and some are
| scary of course). They would ban port 443 to prevent people from
| using DoH if they could without technically cut Egypt out of
| internet.
|
| So yes normally this is not something most of people here are not
| going to like. But as usual reminder, the world is much bigger
| than US and the western Europe.
___________________________________________________________________
(page generated 2023-09-28 23:02 UTC)