How are so many sites OK with using cloudflare when they are basically a MITM? reddit / selfhosted ---------------------------------------------------------------------- spottyPotty · 2023-11-20 07:31 Regardless of whether or not you provide your own SSL certificates, cloudflare still uses their own between their servers and client browsers. So any SSL encrypted traffic is unencrypted at their end before being re-encrypted with your certificate. How can such an entity be trusted? ---------------------------------------------------------------------- thekrautboy · 2023-11-20 07:37 It cannot. Yet this sub is happy to completely ignore the spirit of selfhosting and constantly recommend Cloudflare as a solution to anything. But dont you dare point that out. ---------------------------------------------------------------------- spottyPotty · 2023-11-20 07:41 What do you make of the theory that TLAs are actually behind CF? ---------------------------------------------------------------------- ElevenNotes · 2023-11-20 07:45 Lack of skilled engineers in their team. Lack of infrastructure. Just to name two. You can’t trust CF, you are correct there. You can’t trust any cloud provider, as the saying goes “it’s just someone else’s computer”. Only put in the cloud what you would also put on an external HDD and give to a friend of a friend. I’m prepared for the downvotes. ---------------------------------------------------------------------- certuna · 2023-11-20 07:46 People are looking for a MITM to hide where they actually are. ---------------------------------------------------------------------- tomistruth · 2023-11-20 07:46 Yep. I guess it solves problems that most people don't know how to it themselves. I mean if you are hosting vaultwarden, yeah it's a huge problem. But if all you do is host something for your family and friends or even a company, then the question is how and which apps you route and which you don't. ---------------------------------------------------------------------- ms_83 · 2023-11-20 07:48 Because it’s not always about the encryption. I use Cloudflare tunnels because they are a good way of exposing sites to the internet without exposing my IP or opening ports, which means I don’t have to worry as much about DDoS or other attacks and therefore I don’t need to spend as much effort defending against them. Even Cloudflare decides to inspect my traffic (and seriously why would they care about a tiny hobbyist website) it’s not like it gives them full access to everything, there are other controls you can use depending what your site is for. Honestly what I don’t understand is why some on this sub have such strong objections to Cloudflare. Like I get they are a terrible company in a lot of ways, but name a tech company that isn’t? ---------------------------------------------------------------------- Silencer306 · 2023-11-20 07:49 Why is it a problem with Vaultwarden? ---------------------------------------------------------------------- TheoSunny · 2023-11-20 07:52 The alternative being ..? ---------------------------------------------------------------------- adamshand · 2023-11-20 07:56 It's not. All the Vaultwarden data is encrypted and if CF tampered with it the decryption would fail. ---------------------------------------------------------------------- Bagel42 · 2023-11-20 07:56 Because it's everyones MITM. I trust them with security because it's the only thing they focus on, I focus on making my stuff stop randomly shutting down. If absolutely everyone is using it, I don't care too much if an issue appears- nobody cares about my tiny little thing when Discord goes through Cloudflare ---------------------------------------------------------------------- adamshand · 2023-11-20 07:59 Two reasons for me ... - I don't really care about perfect privacy. I care about controlling the applications I depend upon. - I live in a rural area, and the only fast internet I can get is CGNAT. Cloudflare tunnels is a very convenient way to provide remote access to my services. I could use a VPS instead and run my own proxy, but then I'm trusting the VPS provider. ---------------------------------------------------------------------- spottyPotty · 2023-11-20 08:01 I get that hobbyists hosting their little personal site dont have much need for protecting their traffic but there are large company websites that also use CF. SSL was created to protect data in transit and all these companies are OK with undoing all that. It's like a back-door to all this HTTP traffic that everyone is ok with. People go out of their way to de-Google their phones but them are ok with this situation. ---------------------------------------------------------------------- thekrautboy · 2023-11-20 08:02 Uhm i dont know, selfhosting? ---------------------------------------------------------------------- tomistruth · 2023-11-20 08:02 If I understood it correctly, If Cloudflare handles ssl encryption for vaultwarden they will see the payload in clear text. Agencies that have access to cloudflare can see it. ---------------------------------------------------------------------- ms_83 · 2023-11-20 08:03 What the hell is the “spirit of self hosting” and why do you get to be the arbiter of it? People self host for all sorts of reasons and using CF tunnels might be perfectly in accord with that reasoning. ---------------------------------------------------------------------- TheoSunny · 2023-11-20 08:04 How would you go about self hosting, say a website without revealing your static IP, preventing DDoS attacks, getting around ISP CGNAT all without heavily impacting load times and accessibility across the world? ---------------------------------------------------------------------- thekrautboy · 2023-11-20 08:06 Realistically one has to assume that they are nearly everywhere, especially with large and "free" services that give direct access to userdate, even more so when a majority of those users are led to believe that their data is safe. Not saying all those companies are controlled and run by TLAs, but that doesnt matter, i would be sure TLAs have their direct backdoor access to most of them. They dont need to waste resources running those companies. For those wondering, TLA stands for Three-Letter-Agencies (i think) meaning government agencies like NSA etc. ---------------------------------------------------------------------- thekrautboy · 2023-11-20 08:06 > I’m prepared for the downvotes. *rubs hands* ---------------------------------------------------------------------- thekrautboy · 2023-11-20 08:08 > Even Cloudflare decides to inspect my traffic (and seriously why would they care about a tiny hobbyist website) The good old "eh what do i care i dont have anything to hide" approach to security and privacy. Excellent! *"If you have nothing to hide then you dont have to worry!"* I wont respond further in this thread because i already know how these discussions go. ---------------------------------------------------------------------- bufandatl · 2023-11-20 08:11 Because building a global CDN costs more money than paying cloudflare to use their already established network. And for their servers to cache content they have to store it unencrypted to be able to hash it and see if it has changed at the origin. ---------------------------------------------------------------------- Brent_the_constraint · 2023-11-20 08:13 You need them if you really want to be secure from DDOS... well with knowledge of HTTP2 DOS is enought... :-) ---------------------------------------------------------------------- thekrautboy · 2023-11-20 08:14 Selfhosting doesnt mean you run everything from home. It means you are in control of the hosting. Plenty of options to host things like that yourself. And i have my doubts that the majority of users around here care about "load times and accessibility across the world?". They want to reach their Homepage and Vaultwarden while they sit in a Starbucks. If you want to compete with a CDN etc like Cloudflare, this isnt a fit for selfhosting. ---------------------------------------------------------------------- thekrautboy · 2023-11-20 08:15 > If I understood it correctly You did not. ---------------------------------------------------------------------- thekrautboy · 2023-11-20 08:16 Maybe simply read the description and the wiki of this subreddit? ---------------------------------------------------------------------- spottyPotty · 2023-11-20 08:16 > For those wondering, TLA stands for Three-Letter-Agencies (i think) meaning government agencies like NSA etc. Correct ---------------------------------------------------------------------- tomistruth · 2023-11-20 08:16 Is this documented somewhere? ---------------------------------------------------------------------- ms_83 · 2023-11-20 08:17 Again, that’s your definition of self hosting and that’s fine. But it doesn’t mean people doing it differently are wrong. ---------------------------------------------------------------------- tomistruth · 2023-11-20 08:17 Do you have documentation proof? ---------------------------------------------------------------------- thekrautboy · 2023-11-20 08:21 That is the definition of selfhosting for this sub, and this discussion is happening in this sub, so thats how i am interpreting it right here. If you feel differently about thats fine. Doesnt fit here and being wrong are not the same thing. ---------------------------------------------------------------------- ms_83 · 2023-11-20 08:21 But if you don’t trust Cloudflare, who do you trust, and why? Do you trust your ISP? Do you trust Intel or AMD? The people who manufacture your router or other networking kit? People’s trust boundaries exist at different levels. If you are happy with your own, fine, but you don’t get to tell other people that they are doing it wrong just because their boundaries are different. ---------------------------------------------------------------------- thekrautboy · 2023-11-20 08:22 Yes, Vaultwarden Github. Its all opensource. ---------------------------------------------------------------------- thekrautboy · 2023-11-20 08:22 > Yes, Vaultwarden Github. Its all opensource. ---------------------------------------------------------------------- thekrautboy · 2023-11-20 08:28 As i already replied to you in another comment... that is the definition of selfhosting of this subreddit, which you are now participating in. And no, i dont trust anyone. I dont trust my ISP. I dont trust Intel or AMD. I dont even own a computer. And my house is powered by a diesel generator only 2 hours per day, while its covered completely in aluminium foil. I am writing these reddit comments on post-it notes and every few minutes i send one of my kids on their bicycle to drive to a random neighbour and they post them for me. But youre not getting any more post-its from me, dont worry. ---------------------------------------------------------------------- tomistruth · 2023-11-20 08:28 And? ---------------------------------------------------------------------- thekrautboy · 2023-11-20 08:29 Go read it, come back in a month and tell us what you found. ---------------------------------------------------------------------- qfla · 2023-11-20 08:30 With rented VPS its possible to create reverse proxy without terminating SSL on the VPS so even the company hosting said VPS cannot intercept traffic ---------------------------------------------------------------------- certuna · 2023-11-20 08:31 This sub also deals with hosting VPSes, it's not just about hosting from a home connection. ---------------------------------------------------------------------- tomistruth · 2023-11-20 08:31 The devs literally require a reverse proxy to handle ssl. Where is your proof? ---------------------------------------------------------------------- rollinghunger · 2023-11-20 08:32 Yes, you’re right that there’s a certain amount of trust you need to have in CF… but what are you trusting it to do? And if they fail, what are the consequences? Honest question - even if you are sending your Vaultwarden traffic over CF, and they are watching or attacking, you have to trust that the e2e encryption of Vaultwarden is what’s keeping you safe, right? Not the SSL certs. Does the auth mechanism rely on the SSL certs not to be compromised? I would hope not. For me, it’s about trade offs. https://www.troyhunt.com/cloudflare-ssl-and-unhealthy-security- absolutism/ https://serverfault.com/questions/662946/does-cloudflare-know-the- decrypted-content-when-using-a-https-connection These two data sources kinda sum it up for me - “If you are concerned that cloudflare can read your data - don't use cloudflare.” But I do want to be sure that any e2e encrypted app doesn’t rely on SSL for its “end-to-end”. ---------------------------------------------------------------------- thekrautboy · 2023-11-20 08:35 You clearly lack basic knowledge of these things, its pointless to explain "proof" to you. If you want to belief that Vaultwarden is unsafe in that sense, fine with me, go be happy. ---------------------------------------------------------------------- thekrautboy · 2023-11-20 08:36 > This sub also deals with self-hosting on a VPS, it's not just about hosting from a home connection. I am well aware and i never said anything about hosting only from a connection, on the contrary. > We've had a zillion discussions about this already, no need to go through this again. Yet here we are, as it constantly goes on this sub. ---------------------------------------------------------------------- tomistruth · 2023-11-20 08:37 For proper operation of vaultwarden, enabling HTTPS is pretty much required nowadays, since the Bitwarden web vault uses web crypto APIs that most browsers only make available in HTTPS contexts. There are a few ways you can enable HTTPS: (Recommended) Put vaultwarden behind a reverse proxy that handles HTTPS connections on behalf of vaultwarden. (Not recommended) Enable the HTTPS functionality built into vaultwarden (via the Rocket web framework). Rocket's HTTPS implementation is relatively immature and limited. Refer to the Enabling HTTPS section for more details on these options. ---------------------------------------------------------------------- tenekev · 2023-11-20 08:38 How are you in control of "someone else's computer"? That's definitely against "the spirit of selfhosting" and sounds like a contradiction. I always thought of selfhosting as the act of management, rather than ownership. Yes, you can own most of the resources you manage for privacy reasons (among others) however nothing mandates full ownership. If it was that way, we wouldn't have the internet. And those "spirits" are just personal agendas masquerading as guidelines. ---------------------------------------------------------------------- tomistruth · 2023-11-20 08:38 Rolf ---------------------------------------------------------------------- spottyPotty · 2023-11-20 08:41 Thanks for the links ---------------------------------------------------------------------- thekrautboy · 2023-11-20 08:41 > Rolf One of my best friends´ name is Rolf. Do you know him too? ---------------------------------------------------------------------- autogyrophilia · 2023-11-20 08:42 It's like the heart of the cards. If you trust it enough your configurations will work on the first attempt. ---------------------------------------------------------------------- thekrautboy · 2023-11-20 08:44 And? Copy/pasting from the Vaultwarden page? And now what? Good job! Whos a good boy? Who? Yes you are! Here is your treat. Btw just quickly scroling through your hilarious post history i stumble upon this gem from you: > That is because 10bit is only supported in x265 and not x264 and x265 is more efficient. So clearly you love talking shit when you know nothing about the actual topic. Do you know theres a name for that? Good bye now, i need to get back to work. ---------------------------------------------------------------------- naxxfish · 2023-11-20 08:45 Because it's easier and cheaper than setting up your own SSL tunnel securely. From a non hobbyists point of view, you're paying for them to handle the messy business of maintaining a secure endpoint on the Internet. The sheer amount of bot crap you get hitting your servers as a result of an open SSL port is crazy. Also you are paying for their services as a CDN, which can significantly improve latency and reduce bandwidth bills. Most self hosters won't benefit from a CDN (the volume and global distribution of traffic is too small for it to make much of a difference) or a global internal transit network. Of course you definitely can set up your own SSL terminating proxy (where you own the box/process that unencrypted traffic goes through), it's just a lot more money and effort to do well than most would be willing to dedicate to it. But if you're not ok with your traffic going through a third party maybe it's worth it. Just the mechanics of setting up SSL termination is a faff. Not only do you need to set up SSL properly on your app servers, you also have to do the same on your terminating proxy - and keep the certs renewed, disable insecure configurations, patch your SSL implementation. For many, the convenience of this all being someone else's problem is worth it compared to the privacy implications. ---------------------------------------------------------------------- ndlogok · 2023-11-20 08:45 Mostly they know how cf work but when asking simplicity cf do it ---------------------------------------------------------------------- tomistruth · 2023-11-20 08:46 Komm mal runter Rolf. Entweder quotest du mal was oder du hälst die Klappe. Ich lasse mich gern vernünftig über Änderungen im Quellcode unterrichten, aber die offiziellen Dokumentationen sagen SSL wird über den RP gemanaget. Finder ein weiterer Schlüsselaustausch statt, wenn ja, ist's gut. Aber sachlich bleiben, ja. ---------------------------------------------------------------------- tenekev · 2023-11-20 08:46 Vaultwarden forces you to use encrypted connection. CF terminates it and sets its own, that's true. But the vault itself is encrypted and can be decrypted only on the client. Think of it as an archive with a password being sent over insecure connection. Even if someone captures the file, they would need the password. ---------------------------------------------------------------------- InsertNounHere88 · 2023-11-20 08:48 > People go out of their way to de-Google their phones but them are ok with this situation. people selfhost for many different reasons. you may self host so you can degoogle, but I selfhost so I can but Kubernetes on my resume ---------------------------------------------------------------------- thekrautboy · 2023-11-20 08:48 Dont be rude to me in german. And dont be rude to other readers, stick to english. Bye now. ---------------------------------------------------------------------- tomistruth · 2023-11-20 08:50 Yeah, what about user auth. I know the db is encrypted locally, but that wasn't asked. The transactions between server and client and user auth still relies on ssl. ---------------------------------------------------------------------- Emiroda · 2023-11-20 08:51 In regard to enterprises, they don’t give a rats ass about any potential intellectual property theft. That risk has been written off. What matters is compliance and security. Not having DDOS protection in place can potentially have legal consequences and can be very costly. DDOS protection is either investing millions of dollars in equipment or offloading that responsibility to a company like Cloudflare. ---------------------------------------------------------------------- tomistruth · 2023-11-20 08:51 Ah I didnt even remember you. Yeah, better shut up when you are hostile. ---------------------------------------------------------------------- vikarti_anatra · 2023-11-20 09:00 They think it's not a problem for them. Because they think that: * they have nothing to hide * they don't think CF (or TLAs who have access) will use it against them. (Possible examples: Ukrainian sites, Russian sites who disagree with goverment on at least some things) * they think alternatives are worse - it's...rather difficult to make CF censor you. * they only use CF's DNS services and not other things * It's just easier this way ​ This reminds me of current situation with "AI": There is OpenAI/Anthropic with their APIs (requests are sent via HTTPS but OpenAI/Anthropic are not only need to have access to do their work - they also censor it). There are paid-for alternatives who either host proxies for OpenAI/Anthropic/others (like [OpenRouter.ai](https://OpenRouter.ai)) or host local models for others (hosting require significant resources which will be unusused if you don't query often). There are means to host locally at home if you can. Some people prefer not to use local hosting even when they can do so. ---------------------------------------------------------------------- Ok_Antelope_1953 · 2023-11-20 09:01 i believe cloudflare offers something similar at the moment. they won't intercept origin traffic, which also means you can't use their optimization features. ---------------------------------------------------------------------- PM_ME_YOUR_FELINE · 2023-11-20 09:07 It's the basics of private key cryptography. Modifying encrypted data would cause decryption to fail because the data is digitally signed. ---------------------------------------------------------------------- lilolalu · 2023-11-20 09:07 Well well, you are mixing up a couple of things now. Cloudflare runs a CDN, that's correct. They also run a video streaming Network, fyi. Their tunneling services don't _need_ a global CDN they just happen to have it. they are just re-using parts of their existing infrastructure for extra products they can sell, the same reason why Amazon started selling web services. ---------------------------------------------------------------------- Epistaxis · 2023-11-20 09:08 I trust end-to-end encryption. Then I don't have to trust any of the middlemen. ---------------------------------------------------------------------- Ok_Antelope_1953 · 2023-11-20 09:09 Big companies often don't own their servers either. Sure, you can skip Cloudflare and their MITM, but you are still storing data on a rented server, and 99% of website related stuff isn't encrypted at rest. And even if you encrypt at rest, it's not your computer so you have no way of knowing if your web host can access the content anyway. Having a public website or service on the internet requires trusting other people and companies. Cloudflare so far hasn't shown malicious intent about their operations, and no one else comes close to the features they provide, so most people are stuck with them, whether they like it or not. ---------------------------------------------------------------------- EriksonEnterprises · 2023-11-20 09:11 I personally use cloudflare for the simple fact that it hides my servers IP and provides an additional layer for people to get through. You'd be surprised how many daily attacks are attempted on my site just off the URL alone... So security is my main factor. ---------------------------------------------------------------------- lilolalu · 2023-11-20 09:12 CGNAT is the only good reason for people using cloudflare really. I would prefer a VPS anyways, and it's not correct that you have to trust the VPS provider, that entirely depends on your setup. If you have a proxy running on the VPS which does NOT do SSL offloading and a VPN connection to your Homeserver, the traffic will be encrypted all the way to your services. ---------------------------------------------------------------------- GolemancerVekk · 2023-11-20 09:14 If you want to do serious hosting you use cloud hosting and a CDN (which is what CF was originally). There's plenty of affordable CDN services out there. And yes it only works for static content. You can't prevent DDoS attacks for dynamic content without adequate cloud infrastructure and CF is not the answer to that. Selfhosting at a home ISP is not in the same ballpark and there's no point in mixing the two. I highly doubt anybody's going to DDoS my Jellyfin and if they do that's my ISP's problem. Hiding your IP is ultimately a fool's errand but you can use VPNs and VPSs, same for getting around CGNAT. But again, don't forget we're talking about hobbyist level stuff. ---------------------------------------------------------------------- tschloss · 2023-11-20 09:15 CF is not using „their own“! The certificates the client see must be provided and authorized by the provider of the service. Or put in other words: CF is acting as the hosting provider to the outside, to the clients. The rest of journey is „inside“ the domain of the provider of the service. It is totally normal that traffic has some journey to go and often it never touches the premises of the provider or even a server owned by the provider. The important thing that all the part which from a customer‘s view is „internal to the provider of the service“ (behind the CF address) is responsibility of the provider of the service, no matter what 3rd party services they use. ---------------------------------------------------------------------- ElevenNotes · 2023-11-20 09:16 Always as sinister as it gets 😀 ---------------------------------------------------------------------- tomistruth · 2023-11-20 09:17 Yeah, but auth is still done through ssl. ---------------------------------------------------------------------- thekrautboy · 2023-11-20 09:20 *Alpine sucks!* ---------------------------------------------------------------------- t1nk3rz · 2023-11-20 09:20 It's not entirely true what you said. I use cloudflare -> my Proxyserver -> my machines behind the Proxyserver My Proxyserver has my own certificates loaded and terminates the SSL/TLS connection from cloudflare Even if the data is passing through cloudflare cdn uses the cloudflare certificates my data is encrypted first using my own certificates from the Proxyserver ---------------------------------------------------------------------- lilolalu · 2023-11-20 09:22 What confuses me about the endless love for cloudflare in this subreddit is the fact that most people _think_ they need it to run their services, while they don't. People behind CGNAT are an exception, since their usecase is slightly more complex. They also don't need it but they need to establish a tunnel from a real up to their network, that can be either cloudflare or a self hosted alternative. But for most people: you can just point a ddns to your server, done. If you want a FQDN name pointing to your server, you just edit the the DNS to point the domain name to the CNAME of your dyndns, so exampledomain.com points to my.dyndns.org. The fear if getting DDoS attacks on your Homeserver is ridiculous. A DDoS attack exposes the attacker as well, since the originating ip adresses will be investigated and blocked. So they wouldn't just DDoS anyone for fun and burn their compromised ip's for nothing. Cloudflare in my opinion gives a false sense of security since a lot of people seem to think it replaces the need for a firewall. ---------------------------------------------------------------------- mkosmo · 2023-11-20 09:22 > they don’t give a rats ass about any potential intellectual property theft. That risk has been written off That's not true. It's a mitigated risk through contract. ---------------------------------------------------------------------- ElevenNotes · 2023-11-20 09:23 😱 😭 ---------------------------------------------------------------------- spottyPotty · 2023-11-20 09:24 When I visit one of the sites I manage, that goes through CF (my personal ones don't), I see that the certificate that the browser sees is one provided by CF and not the one that I create using LetsEncrypt. ---------------------------------------------------------------------- tcpWalker · 2023-11-20 09:26 Cloudflare has pretty good rep. Building out your own CDN is great if you have the traffic to justify it (think Facebook's FNA's) but is a major undertaking. ---------------------------------------------------------------------- GolemancerVekk · 2023-11-20 09:26 > I use Cloudflare tunnels because they are a good way of exposing sites to the internet without exposing my IP What difference does that make? I only ever heard one realistic reason for hiding your IP, which was a guy living in a suburban neighborhood with static IPs where the IP indicated his house almost exactly. If you have a dynamic IP it will get recycled. If you get a static IP it will eventually get mapped to your precise location, Google & other big data spend a lot of time doing exactly that. > or opening ports [...] or other attacks If your services are accessible from the internet they are accessible... doesn't matter that you don't open ports in your local LAN, there's still an ingress pathway, and encrypting the tunnel doesn't mean your apps can't get hacked. > I don’t have to worry as much about DDoS How many DDoS's have you been through? Lol. CF will drop your tunnel like a hot potato if you were ever targeted by a DDoS. If you think your $0/month plan is getting the same DDoS protection as the paid accounts you're being super naive. Let me translate [this page](https://www.cloudflare.com/application-services/products/ddos- for-web/#DDoS-Page-Pricing-AS) for you: your DDoS mitigation for $0/mo amounts to "basically nothing". Any real mitigation starts with the $200/mo plan. ---------------------------------------------------------------------- radakul · 2023-11-20 09:29 TL;DR - You don't matter, I don't matter, even a company with 10,000 employees doesn't matter. There's too much volume of traffic. Be smart, take necessary precautions, but keep the tinfoil hat off - realistically, there's enough bad actors who are *actually* out to get you, not a company like CF who typically operates in good faith. Longer rant: You need to realize the *sheer scope and volume* of traffic that an organization like CF deals with on a minute-by-minute or hourly basis. They honestly, genuinely, and truly **do not care** what piddly traffic you have going to your home network. There are terabits upon (probably) petabits of traffic per second traversing their network. Do you really think they have the time to stop, ask a (very well-compensated and highly skilled) engineer to drop everything and go snoop on /u/spottyPotty's traffic? 98.9% chance of a "no", unless there is: 1) A threat to life/security 2) Evidence of extreme crimes (CP and the like) 3) Deep/darkweb activity linked to #1 and #2 above 4) An active investigation with a *federal* agency, since you'd need at least FBI/DOJ-level subpoenas to get anything out of a company as large as CF etc. With corporations, they sign NDA's and have iron-clad SLA's, SLO's, KPI's and such to measure everything. Trust me when I say - no one with two brain cells to rub together is going to jeopardize their livelihood in the office chance they catch a snoop containing something even worth snooping. Even if they do, I can only imagine how many hoops they have to jump through - something tells me they have significant security measures in place before you can just "decrypt" something. ---------------------------------------------------------------------- t1nk3rz · 2023-11-20 09:29 It means you are not terminating the SSL/TLS connection properly or you may have some strange config in the cloudflare dashboard ,don't proxy all your traffic in the dns page just for resolve. ---------------------------------------------------------------------- psychowood · 2023-11-20 09:34 I mean, we trust Root Certification Authorities, which are basically self-proclamed-as-trusted entities. At least CF became widespread and is community-trusted :) ---------------------------------------------------------------------- bufandatl · 2023-11-20 09:43 And what do I mix up exactly. OP was concerned about MITM and in that sense a CDN is the perfect MITM they encrypt from client to their cache and from their cache to the origin if that connection is even encrypted. So the data is clearly readable for cloudflare on their CDN. And if a company wouldn’t want that but have the benefits of a CDN they would have to build their own. And cloudflare service in the beginning was DNS and CDN. It just has grown over time with additional services like your mentioned video streaming and zero trust. And their tunnel service would be able to do way more than just read the stream between client-cdn-origin. Their tunnel has a piece of software running in your network. If they wanted they could use it to scan your network and do way more than just MITM. ---------------------------------------------------------------------- lilolalu · 2023-11-20 09:46 I think the discussion here is about a different product they offer, the tunneling service, not proxying. ---------------------------------------------------------------------- ms_83 · 2023-11-20 09:49 Right, so you have nothing useful to add, got it. ---------------------------------------------------------------------- Cybasura · 2023-11-20 09:51 Thats not what a MITM is A MITM is a Man-in-the-Middle Attack, someone whom you dont trust or dont know has hijacked your network connection to either read, remove or modify data from your network packets and then proxy-send it to your initial intended target Cloudflare is a proxy server, a person you TRUST and designated to passthrough first to scan and check for network security before it redirects and pass your packets through to your intended target, like a gatekeeper What, you gonna call all your gatekeepers, your bouncers, your proxy servers a MITM? ---------------------------------------------------------------------- ms_83 · 2023-11-20 09:52 But that paragraph says nothing at all about the networking element, which is where CF exists. Does that also mean you have to self-hosted your own ISP for your discussion to be valid in this sub? ---------------------------------------------------------------------- spottyPotty · 2023-11-20 09:53 Good point. Who's to say that LetsEncrypt doesn't keep a copy of my private keys. ---------------------------------------------------------------------- ms_83 · 2023-11-20 09:57 >If your services are accessible from the internet they are accessible... doesn't matter that you don't open ports in your local LAN, there's still an ingress pathway, and encrypting the tunnel doesn't mean your apps can't get hacked. Which is precisely why I said there are "other controls" that can be put in place. Nowhere did I say that CF is the be-all and end-all of my config from a security standpoint. >If you think your $0/month plan is getting the same DDoS protection as the paid accounts you're being super naive Where did I say this? I didn't. Honestly reading comprehension in this sub is really poor. ---------------------------------------------------------------------- capecodcarl · 2023-11-20 10:08 A certificate authority doesn't have a copy of your private key, you send them a certificate signing request. The private key never leaves your system. That's the whole point of public key encryption. ---------------------------------------------------------------------- bufandatl · 2023-11-20 10:16 In the end doesn’t really matter what services the discussion is about. If you don’t trust cloudflare you need to build the services you use yourself and depending on the service it may cost just a few bucks a month. Or hundreds if not thousands a month. ---------------------------------------------------------------------- spottyPotty · 2023-11-20 10:18 Then trusting root CAs is a non-issue? ---------------------------------------------------------------------- Simon-RedditAccount · 2023-11-20 10:24 * I'm OK with MITM for my blog, that collects zero personal data from people. * I'm not OK with MITM for my Nextcloud etc. Never using CF for this; actually using a separate second-level domain for it with strict CAA (so that *almost* no one except me would be able to issue a TLS cert). ---------------------------------------------------------------------- AnApexBread · 2023-11-20 10:25 Because the level of security they provide is worth the minor loss in privacy ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-20 10:25 Bro, 1. you cant trace DDos sources because they are bots / proxys anyways. 2. If you host gameservers etc and someone is Salty => ur beeing ddossed. 3. It does if you use cf tunnel and use their Web application Firewall. Its only a false sense of security when you dont know how shit works. ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-20 10:26 Cmon Bro.... you made him cry. Ps: still a Fan ---------------------------------------------------------------------- lilolalu · 2023-11-20 10:27 Kind of a catch-22, if you know how shit works you don't need cloudflare. ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-20 10:28 Aight. How do you mitigate DDos attacks without cloudflare or akamai? The only thing that i could think of is bgp with your ISP, but iam 99% sure its way to expensive for home Users. ---------------------------------------------------------------------- lilolalu · 2023-11-20 10:29 99% of the people use cloudflare in this subreddit to have a fixed IP to have a domain name point at their servers. You can achieve that with a 5$ per year domain name and a free dyndns. ---------------------------------------------------------------------- spottyPotty · 2023-11-20 10:37 Well, my main curiosity isn't about my personal or client sites with limited traffic, but larger companies' sites, especially with messaging features. There have been stories of the CIA tapping into intra-continental fibre optic cables so the resources to scan such volumes of traffic doesn't seem to be a deterrent. Also, scanning the traffic would be performed autonomously and not by a physical person. There have been a number of reports by the EFF and others about the attempts by intelligence agencies to enforce the inclusion of back doors in async key encryption. I don't think that the capabilities required to perform such large- scale snooping are beyond intelligence agencies. ---------------------------------------------------------------------- am_kobold · 2023-11-20 10:39 A DDoS attack most definitely does not expose the attacker, it's done by botnets, usually in foreign countries, or from completely random home IPs through compromised devices (often IoT device). Getting DDoS'd on a home server is fairly realistic? I've been hosting a small web game for 10+ years and have in that time been at the receiving end of multiple multi-Gbit/s DDoSes, until I decided that Cloudflare is the way for me. They're extremely cheap to run, and sometimes you can quite literally pay a fishy site like $2 for a "stress test" on someone else's address. Though I'm note sure what role CGNAT plays here, this is not about Cloudflare \_Tunnels\_, this is just about Cloudflare's main service, which is a MITM/DDoS protection service. ---------------------------------------------------------------------- violet-crayola · 2023-11-20 10:41 Yeah but cloudflare point is hundreds of locations that are close to consumer. One cache server won't be equivalent to your own cloudflare,you would have to roll out hundreds if servers ---------------------------------------------------------------------- lilolalu · 2023-11-20 10:43 I am running my homeserver for over 10 years, never got DDoS attacks. I don't KNOW anyone whos home server ever got DDoS'ed. It's a hypothetical scenario. If it happens: this affects the network performance of my ISP and their Uplink, so they will take care of it. Tldr it's a BS scenario and if it happens your server will not be reachable for a day or so. ---------------------------------------------------------------------- lilolalu · 2023-11-20 10:45 If I wanted to run a server with lots of users, I would definitely not run it at home. ---------------------------------------------------------------------- lilolalu · 2023-11-20 10:49 https://nira.com/how-to-trace-a-ddos-attack/ ---------------------------------------------------------------------- lilolalu · 2023-11-20 10:49 https://nira.com/how-to-trace-a-ddos-attack/ ---------------------------------------------------------------------- radakul · 2023-11-20 10:52 You are conflating two completely separate topics - a private, for- profit entity such as CF and a nation's intelligence agency. > Well, my main curiosity isn't about my personal or client sites with limited traffic, but larger companies' sites, especially with messaging features. Messaging features, such as...? WhatsApp? E2EE. Signal? E2EE. iMessage? E2EE. Telegram? E2EE. If it's E2EE, you *can't* see the contents, even if you MITM the traffic in transit - without the private key, the contents aren't visible, period. Sure, a nation- state or agency like the NSA can, and likely has, broken that encryption but again - are they going after the person sharing memes, or the person planning the next mass shooting? My money is on the latter. > There have been stories of the CIA tapping into intra-continental fibre optic cables so the resources to scan such volumes of traffic doesn't seem to be a deterrent. Yes, the trans-atlantic fiber optic cables are tapped (by the NSA, not CIA). This is a known fact. There's dozens of reasons why but, again, the *sheer volume* of traffic means they can't pick out everything - it very likely has to hit multiple red flags. > Also, scanning the traffic would be performed autonomously and not by a physical person. Scanning traffic may be automated, but that automation is typically passed to a human for inference/validation - no automated system is perfect, and there is always a human, somewhere, for validation. > There have been a number of reports by the EFF and others about the attempts by intelligence agencies to enforce the inclusion of back doors in async key encryption. Again, these were revealed by Edward Snowden and various other leaks - yes, these are known issues. Yes, security professionals are aware of this, but again you can't stop using the Internet in this day and age, so what can you do? Be smart. Take *reasonable* precautions. Don't commit cybercrimes/fraud. I imagine 85-90% of the average population either a) doesn't know, b) doesn't care or c) is absolutely clueless to what is going on around them. The remaining 10% might include Cybersecurity, networking & IT professionals, along with the (relatively small) percentage of bad actors who conduct attacks (including script kiddies, hactivists, nation-states, etc.) I get the point you're making, but again, it's all relative. Who might an intelligence agency spend resources on? My bet is it's the bad actors and nation states, not memes on Discord. ---------------------------------------------------------------------- am_kobold · 2023-11-20 11:04 "Use Forensics to Help You Investigate the DDoS Attack". Do you think your home user can afford to pay professionals multiple hundreds of dollars an hour to trace their personal address being DDoSed. Did you just paste me the first Google result for "how to trace a DDoS attack"? Did you even read it? ---------------------------------------------------------------------- kring1 · 2023-11-20 11:05 It is, but for a different issue. Every CA you trust can create certificates for every site. If you trust the e.g. NSA CA, they can create a certificate for gmail.com and put a MITM between you and gmail. [The EU is planning to force browsers to add their backdoor CA](https://www.eff.org/deeplinks/2021/12/eus-digital-identity- framework-endangers-browser-security) ---------------------------------------------------------------------- silversurger · 2023-11-20 11:06 A root-CA can still swap out your certificates, but they do not have access to the private keys. What they can do is issue valid certs for domains not under their control (or the control of their users). With a bit of DNS poisioning you can now serve traffic through a Proxy and no one would notice (think: someone obtains a valid cert for google.com, sets the local DNS to resolve google.com to the IP of a server hosting a proxy and et voila, you can read all their encryapted traffic). ---------------------------------------------------------------------- neskes · 2023-11-20 11:06 you never hosted a public minecraft or CS server, did you? or it's always empty right? calling this BS because you never experienced it, is the real BS. ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-20 11:08 Lmfao. Thinking this works. Companys are stupid as fuck then to pay for ddos mitigation.... ---------------------------------------------------------------------- lilolalu · 2023-11-20 11:08 No, I did not. And have absolutely no interest in. If I had interest in hosting a service used by a huge amount of users, I would definitely not host it at home. ---------------------------------------------------------------------- neskes · 2023-11-20 11:09 It's not really about the amount of people, it's the characters of people you attract. 12-17yo that pay 10€ psc for a quick ddos attack from a ddos vendor ;) ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-20 11:09 Good for you. But you cant talk then... Getting hit with 3 Attacks at least every month. And no your ISP wont take care of it.... Not if you dont buy ddos protection from your ISP. So? If my homelab isnt reachable, then my companys mailserver + cash register isnt working. Please stop talking when you clearly have no idea what your talking about ---------------------------------------------------------------------- certuna · 2023-11-20 11:10 You can DDNS that with Cloudflare too, just use them as the domain registrar and just make your AAAA/A records point to your own IP addresses. You don't \*have\* to use their proxy. ---------------------------------------------------------------------- lilolalu · 2023-11-20 11:11 I think you are mixing up a couple of things. It's possible to trace DDoS sources, even for you at home. But there is little you can do on your Homeserver about it. This article is talking backbone level DDoS mitigation and there is a lot they can do. In any case, it's absolutely no problem to trace DDoS sources and it can and will have repercussions for them, even if it's just colateral damage because your computer was infected with a botnet. ---------------------------------------------------------------------- spottyPotty · 2023-11-20 11:12 All fair points. ---------------------------------------------------------------------- lilolalu · 2023-11-20 11:12 Yeah, that's probably true ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-20 11:12 1 Guy is enough to Ruin your day. And if you only use it for yourself you dont need to expose shit ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-20 11:13 Omg man. If 6000 IP's hit you. And not a single one of them Belongs to the attacker, what the hell do you want to Trace? And why talk about backbone ddos mitigation? Since you pay for that aswell. Ur saying: You dont need ddos protection, but then you talk about backbone ddos protection which is paid aswell ---------------------------------------------------------------------- spottyPotty · 2023-11-20 11:19 Isn't this also what many companies do to monitor web-traffic from their network? ---------------------------------------------------------------------- lilolalu · 2023-11-20 11:20 You said it's not possible to trace them. It is possible and it's not even complicated. Does it help you.. Probably not... For me it's just counterintuitive that people want to run large scale services on a consumer grade internet connection. If I wanted to host a server frequented by hundreds or thousands of users, I would choose a service provider that is equipped to do this and not run this over my home cable connection. And "equipped" for running these types of services (as apparently you want to run from home) also means DDoS mitigation. ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-20 11:24 Your Equipent doesnt help shit. I got Servers for 30k+ Euros and they dont mitigate shit. I got Business Internet aswell, but with no ddos mitigation since it would be at least 200 euros a month. (Cloudflare is free). If you have the need for Data beeing available at home, this is the only option. And maybe you should start at the FBI? Since they cant even shutdown the most popular ddos Service Providers. And even if they shutdown one, 5 will follow. + you only get the botnet Providers not the people that actually have attacked you ---------------------------------------------------------------------- lilolalu · 2023-11-20 11:25 It's not a question of equipment but of skills of the response center of your hosting provider. ---------------------------------------------------------------------- lilolalu · 2023-11-20 11:27 If you identify the source of DDoS attacks you can just block their routing in a backbone level. To do that you need to identify them. ---------------------------------------------------------------------- worldcitizencane · 2023-11-20 11:29 Probably the same way that a lot of people are ok with using Gmail. ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-20 11:29 Why skills? You would pay a shit load of money to get mitigation / nullrouting from your ISP. And all datacenter ddos protection still fucks up when getting attacked with a good ddos service. Doesnt matter. Hetzner / OVH / DSH with all those Services, your Server goes down even if they have "ddos protection" ---------------------------------------------------------------------- lilolalu · 2023-11-20 11:30 Okay ---------------------------------------------------------------------- WisdomSky · 2023-11-20 11:32 Get some reading comprehension. He said MITM and not MITM Attack. He's referring to Cloudflare as a middle man. What OP is trying to say is why everyone is okay with using Cloudflare when it basically is a middle man where your traffic/requests go through and could potentially be sniffed at. ---------------------------------------------------------------------- certuna · 2023-11-20 11:44 These bots are infected phones, PCs, televisions and routers on the local networks of random people at home. There are millions of them. Even if you report bot traffic and trace it back to an individual customers, ISPs are not going to permanently block those IP addresses (or in the case of IPv6, their subnet), they would lose half their customers. If they're using CG-NAT, they are definitely not blocking IP addresses. ---------------------------------------------------------------------- lilolalu · 2023-11-20 11:45 No they will not permamently be blocked, but they will be blocked temporarily. How else do you think DDoS mitigation works? ---------------------------------------------------------------------- certuna · 2023-11-20 11:49 Straight from that link: >Alternatively, you can redirect traffic to a CDN (Content Delivery Network) and use a web application protection service to minimize the intensity of the attack. ---------------------------------------------------------------------- lilolalu · 2023-11-20 11:53 Ok, focus: the point in the discussion was, that DDoS attacks cannot be traced. Thats wrong: tracing the sources is the starting point of mitigating DDoS attacks ON A NETWORK LEVEL. There is little you can do FROM HOME. But its a fucking ridiculous idea to run high availability services on your consumer grade home link in the first place. Its like wanting to Join Fedex delivery services with a 1970's station wagon. ---------------------------------------------------------------------- AttackCircus · 2023-11-20 11:57 It's all a matter of trust. There are many reasons to selfhosting. Paranoia is just one of them. ---------------------------------------------------------------------- _qqqq · 2023-11-20 12:00 Most DDOS mitigation works by having a big enough pipe to absorb extra traffic and filter what they can pass through as legitimate looking. This doesn't help when traffic looks legitimate enough of course. Null routing works when you can identify source IPs, this often isn't the case as spoofing can be utilized (remember, an attacker doesn't always want a response). Even with null routing you're often times talking about botnets with hundreds of millions of source/reflection devices. Finally, when you see DDOS mitigation advertised by hosting providers, that often means they are protecting you from attacks against other clients hosted within their infrastructure. If you're the target of the attack they'll simply null route your IP(s) as far out to the edge as they can. ---------------------------------------------------------------------- Cypher_Dragon · 2023-11-20 12:00 Technically, all SSL CF connections have end-to-end encryption. You just misunderstand where the endpoints are. ---------------------------------------------------------------------- lilolalu · 2023-11-20 12:03 In any case, they have tools to deal with this, which you do not have at home. So hosting high availability gaming servers over your cable modem from your cupboard and thinking that cloudflare will make you able to compete with a proper hosting providers response teams seems a little delusional. ---------------------------------------------------------------------- sjsathanas · 2023-11-20 12:06 CF provides different encryption modes. So if it's "Full" you'll need a valid SSL cert on your server, which CF will use end-to-end. If it's "Flexible" (IIRC), then you don't need a cert on your server, in which case CF will use their own cert for encryption. ---------------------------------------------------------------------- ElevenNotes · 2023-11-20 12:07 Him? Dude my pronouns are “apk and lbu”. ---------------------------------------------------------------------- Cypher_Dragon · 2023-11-20 12:11 Speaking from experience, companies that are trying to do this will typcially do it one of two ways: either through DNS lookups by having their on-network DNS server acting as a recursive server, thus being able to intercept/interpret DNS requests and apply filtering rules, OR through a forward proxy that all web traffic exiting the company network will go through. Forward proxies can absolutely be configured for SSL interception, and it's typically handled by using a company- issued certificate signed by the company's CA...and every company computer has the company's CA certificate installed, so it's explicitly trusted. This is why you shouldn't do any kind of personal business (especially banking) on company-owned devices. The biggest difference between companies using a forward proxy and an attacker using DNS poisoning to redirect the traffic is intent - the attacker is doing it for explicitly malicious purposes, while the company is ostensibly doing it to enforce company policy (especially AUPs)...having access to all the delicious unencrypted data is simply a side effect. You trust your employer, don't you friend citizen? ---------------------------------------------------------------------- certuna · 2023-11-20 12:15 Still, hobbyists don't want their small-scale game server DDoS'ed, or their OwnCloud server's home IP address exposed through the A/AAAA record and get hammered 24/7 by bots trying to get in. In the end, that's what people use Cloudflare for: some big shoulders to hide behind. Cloudflare offers anonymity towards the entire internet except Cloudflare. If you self-host from home without anything in front of your server, the entire internet knows where you are. ---------------------------------------------------------------------- lilolalu · 2023-11-20 12:17 I am not self hosting public services which are used by a large user base on my home servers. Thats exactly the point. If i wanted, i would rent a server for that purpose. ---------------------------------------------------------------------- certuna · 2023-11-20 12:17 My point is, using those IP addresses for an attack on you doesn't invalidate those IP addresses, they'll still be useful for the next attack. That makes initiating a DDoS attack a much lower-threshold action. ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-20 12:18 Dude? I identify as a mechanical Keyboard.... ---------------------------------------------------------------------- Cybasura · 2023-11-20 12:22 No, I read it properly, a MITM generally refers to MITM Attack and vice versa in cybersecurity, it is down to the individual to clarify if they meant otherwise and clearly, this case he is referencing to BEING A MITM for malicious purposes ---------------------------------------------------------------------- Quique1222 · 2023-11-20 12:23 A lot of people in this thread have never been ddosed and it shows. You don't need to host a super popular thing to get ddosed. When you host game servers there is gonna be salty 16 years old that go to a free stressed and hit you with 1gbps. And you might think "well yeah but it's not like cloudflare's free plan protects that much". It does, believe me. I've done tests with people who have access to botnets and without cloudflare with 1gbps our connection was dead. With cloudflare it didn't go down and reported more than 50gbps on the cloudflare dashboard. Also another thing is that a lot of these people are 16 year old script kiddies, and not seeing your IP directly discourages them. ---------------------------------------------------------------------- fellipec · 2023-11-20 12:24 If you want then to cache your content to reduce the load of your servers, they have to decrypt the traffic. This is how a reverse proxy works. And, well, you have to trust them before contract their services. The same way people trust vpns to route their traffic. If I was from some 3 letter agency and want to spy on potential illegal content, I would tap into a vpn server. ---------------------------------------------------------------------- rbooris · 2023-11-20 12:25 Yes and in addition, that user has not explained the differences between the free and paid DDoS mitigation solutions... typical online sterile discussion sadly. ---------------------------------------------------------------------- ElevenNotes · 2023-11-20 12:26 So ... klickety and klackety? ---------------------------------------------------------------------- edthesmokebeard · 2023-11-20 12:32 The company owns the VPS. They can just steal your certs. ---------------------------------------------------------------------- SageThisAndSageThat · 2023-11-20 12:38 > Because it's easier and cheaper than setting up your own SSL tunnel securely. Wut you can easily set up SSL with let's encrypt and traefik. What CF gives you that you can't really do yourself is CDN ---------------------------------------------------------------------- amunak · 2023-11-20 12:40 Because it's "everyone's MITM" it would make it a perfect spot for state actors to tap into in order to surveil pretty much everything without anyone being able to notice. Hell, just the server logs (timestamps, IP addresses and exact URLs) would be unbelievably valuable. I'd be really surprised if *someone* wasn't taking advantage of that. Which is to say if you selfhost because you want more control and privacy, you probably want to avoid services like that. ---------------------------------------------------------------------- Oujii · 2023-11-20 12:44 The company that owns your virtual machine can do lots of different things to snoop on you if they want to, they control your host so possibilities are limitless. ---------------------------------------------------------------------- FirArAlDracuDeCreier · 2023-11-20 12:45 The guy you're replying to is part of a a phenomenon that's been around since the olden days of the internet: the "alpha nerd." He is obviously intelligent, knows stuff... also is stubborn, doesn't know how to deal with other people and accept that someone *else* might know some stuff he doesn't, then posts /to/iamsosmart material, long posts that add nothing material. He'll mature, I know I've come a long way and I used to be an edge- lord extraordinaire 😳😱🤣 ---------------------------------------------------------------------- Oujii · 2023-11-20 12:49 Why people with popular opinions are always the one mentioning downvotes? ---------------------------------------------------------------------- crackanape · 2023-11-20 12:49 > Honestly what I don’t understand is why some on this sub have such strong objections to Cloudflare. I am concerned about them being a technical SPOF for much of the internet, and there is the possibility that some hitherto unknown long-term persistent data gathering infiltration is able to sweep up a massive amount of information. And maybe they will turn malicious? Who can say? There's plenty of precedent. How long between when it happens and when we find out? ---------------------------------------------------------------------- FirArAlDracuDeCreier · 2023-11-20 12:49 > You trust your employer, don't you friend citizen? You damn well do **iff** you wanna pay that mortgage, peasant! 🤑 ---------------------------------------------------------------------- crackanape · 2023-11-20 12:51 Unfortunately doesn't help you if your own hardware is your enemy. ---------------------------------------------------------------------- Oujii · 2023-11-20 12:54 Does Cloudflare provide free IPv4 addresses? ---------------------------------------------------------------------- discourseur · 2023-11-20 12:55 And DDoS protection ---------------------------------------------------------------------- discourseur · 2023-11-20 12:57 Why are you downvoted??? ---------------------------------------------------------------------- Emiroda · 2023-11-20 12:58 That's true, I didn't specify the circumstances. In the case of overt IP theft, the contract is the mitigating factor. However in the case of convert IP theft through systematic, transparent surveillance of traffic (what OP is alluding to), it's something that you cannot really mitigate apart from just not being digitally present. Cloudflare is a player there, but so is any ISP and nation state who is curious enough. To be on the internet, you have to accept the risk that systematic surveillance can impact your intellectual property. In some cases, your mitigating factor is the law. But it's really difficult to prove that Cloudflare might be sniffing your data and using the IP unlawfully and it's downright impossible to prove that the NSA or foreign intelligence is using your IP. ---------------------------------------------------------------------- Oujii · 2023-11-20 12:59 CF would limit you on downloads or uploads anyway for NextCloud. ---------------------------------------------------------------------- ElevenNotes · 2023-11-20 13:04 Experience. Especially if you talk against the status quo which in /r/selfhosted and /r/homelab is the use of Cloudflare for ease of use and protection for people exposing services at home. If you say something against Cloudflare you put a target on your back on both these subs, that’s also why I got banned in /r/homelab, for speaking against the status quo and this was seen as an “asshole” move. ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-20 13:09 Yep. But be carefull, WASD and Space are silent Keys! ---------------------------------------------------------------------- Big_Booty_Pics · 2023-11-20 13:14 SMH, you haven't run your own underground fiber lines to the rest of the world? Not much of a selfhoster I see... /s ---------------------------------------------------------------------- Oujii · 2023-11-20 13:19 Unfortunately for you example, you can’t host game servers through Cloudflare free plan, so they would still DDoS you because you’d be open. ---------------------------------------------------------------------- DeviousBeevious · 2023-11-20 13:23 not if they do encryption properly. ---------------------------------------------------------------------- shellmachine · 2023-11-20 13:25 Half of the people don't remotely understand the issue. The other half is aware that what's in behind isn't trustworthy anyways if it's "in da cloud" and just went all YOLO-mode. ---------------------------------------------------------------------- mrkesu · 2023-11-20 13:28 >People go out of their way to de-Google their phones but them are ok with this situation. I don't think this venn-diagram is a circle. ---------------------------------------------------------------------- teem · 2023-11-20 13:31 What is it you're afraid cloudflare is doing? This is a company trusted by tons of corporations who have legit secrets to protect. Why would they care intercepting your traffic? To what end? Cyber attacks are goal-oriented and based on attack cost, basically how much effort for how much reward. Is your selfhost traffic super valuable? So valuable that someone would hack cloudflare to get it? In reality, other than commodity malware that your security suite should easily pick up, there isn't much threat in my opinion. ---------------------------------------------------------------------- teem · 2023-11-20 13:33 And how could you check? This paranoia isn't really worth all the effort. I've worked at a few cyber security start ups and they always have the worst internal security practices. ---------------------------------------------------------------------- teem · 2023-11-20 13:33 Not sure why the downvotes. There are documented cases of this exact thing happening. ---------------------------------------------------------------------- readit-on-reddit · 2023-11-20 13:35 You don't need to use CF tunnels to get DDoS protection and to hide your IP. If you are using CF tunnels without being undee a CG-NAT then you are getting MITM'd for nothing. ---------------------------------------------------------------------- teem · 2023-11-20 13:36 Which in my years of experience is generally terrible. ---------------------------------------------------------------------- DeviousBeevious · 2023-11-20 13:42 It does depend on the host, you are right. Amazon do a pretty good job. they have a LOT of protections in place because some of the people they support have DEEP pockets if things go wrong. ---------------------------------------------------------------------- therealsimontemplar · 2023-11-20 13:47 Cloudflare’s default setup is to proxy your traffic but that’s easily disabled with a click of the admin’s mouse. Of course disabling their proxy service exposes the origin IP’s, server certs, etc. but the point is that you use Cloudflare services the way you want to; it’s not a Boolean “cloudflare or no Cloudflare”. ---------------------------------------------------------------------- Quique1222 · 2023-11-20 14:05 I know, because cloudflare only proxies http traffic, and that was what i was talking about. That has nothing to do with my comment tho. With minecraft you can use TCPShield which is the same as cloudflare. ---------------------------------------------------------------------- highedutechsup · 2023-11-20 14:06 It's why I always sort by controversial, its where the real info is. ---------------------------------------------------------------------- aswan89 · 2023-11-20 14:09 My method is to turn my vps into an overpowered router by doing NAT from the VPS to my home machine over wireguard. I'm not that concerned about privacy, its more that I want to keep my home machine isolated from the internet but also want the convenience of using wildcard Lets Encrypt certificates. ---------------------------------------------------------------------- Psychological_Try559 · 2023-11-20 14:14 Thanks for the link, it's an interesting read with more detail than I've ever heard (not having used cloudflare for this myself). ---------------------------------------------------------------------- HumbledB4TheMasses · 2023-11-20 14:27 Beyond what everyone else has said here about it being practically an industry standard now with insane levels of trust, it also foists a lot of the responsibility for security/uptime onto an external company with a good track record. That's great in the eyes of product management and likely the legal department too. ---------------------------------------------------------------------- MarcusBuer · 2023-11-20 14:36 Because he is wrong. Even if you had static IPV6 with direct access to your device, CF would still useful. ---------------------------------------------------------------------- FallenFromTheLadder · 2023-11-20 14:39 >That’s the whole idea of Cloudflare - many people actually want a MITM in order to hide where they actually are and/or deflect DDoS traffic. This is the actual service they provide, it’s not some secret. You can have a level 3 MITM but not on the TLS level. ---------------------------------------------------------------------- Whitestrake · 2023-11-20 14:40 Oh shit for real? How? ---------------------------------------------------------------------- M4Lki3r · 2023-11-20 14:41 Do you want to be blown off the internet by DDoS? How much bandwidth do you have/can you pay for? ---------------------------------------------------------------------- kn33 · 2023-11-20 14:49 I think /u/Ok_Antelope_1953 is talking about just turning off the "proxy" option when creating the DNS record. When you do that, it doesn't proxy and it just makes a regular DNS record. ---------------------------------------------------------------------- Defiant-Ad-5513 · 2023-11-20 14:49 Turn off the Orange cloud icon ---------------------------------------------------------------------- kn33 · 2023-11-20 14:51 That's very limited in what you can do to detect malicious traffic. It's also going to get less as ECH becomes a thing - since some of the functionality of detecting malicious traffic comes from doing SNI inspection. Decrypting and re-encrypting is a lot more effective at detecting malicious traffic. ---------------------------------------------------------------------- Ampix0 · 2023-11-20 14:53 Oh no. My public blog ---------------------------------------------------------------------- wanze · 2023-11-20 14:58 You could say the same about any cloud provider. "AWS can read all my data! The horror!" ---------------------------------------------------------------------- wanze · 2023-11-20 15:04 >Only put in the cloud what you would also put on an external HDD and give to a friend of a friend. What a ridiculous take, honestly. I work in the payment industry. We run our entire infrastructure on AWS. According to you, I might as well just hand over all card data to my friend's friend? PCI DSS, our auditors and our lawyers beg to differ. ---------------------------------------------------------------------- ElevenNotes · 2023-11-20 15:09 Until it does because of security breach within AWS. Remember the MS cloud fiasco with their key that got used to create thousands of access tokens to all apps on their cloud? Nice isn’t it. ---------------------------------------------------------------------- thekrautboy · 2023-11-20 15:10 > According to you, I might as well just hand over all card data to my friend's friend? PCI DSS, our auditors and our lawyers beg to differ. Dont confuse /r/selfhosted with /r/sysadmin... ---------------------------------------------------------------------- Whitestrake · 2023-11-20 15:11 Oh, yeah, grey cloud. Here I thought they meant you could have Cloudflare proxy without terminating TLS. Ahh well. ---------------------------------------------------------------------- wanze · 2023-11-20 15:12 Is your argument really that because some providers had issues, that you can't trust any providers more than "your friend's friend"? ---------------------------------------------------------------------- WorthyFroglet · 2023-11-20 15:12 If you use CF for DNS and turn on the proxy, they still MITM you. ---------------------------------------------------------------------- Patient-Tech · 2023-11-20 15:14 Depends what you’re putting on there. If it’s some blog that’s out there for the world to see, and if you’d like to have more traffic checking it out, then privacy isn’t your goal. Now your personal data, yeah that’s different. I have that stuff segregated. ---------------------------------------------------------------------- wanze · 2023-11-20 15:15 Yeah, I had thought there would be more overlap. It's embarrassing how it's apparently accepted that "cloud bad" when the entire industry disagrees. Every tech company out there uses cloud providers quite successfully. A cloud provider will have a much bigger team to ensure everything is up-to-date and patched than most other companies running their own servers. ---------------------------------------------------------------------- Patient-Tech · 2023-11-20 15:17 Don’t forget, for selfhosters, the value proposition of free is always pretty strong. I have tiers of data and not everything needs to be super private at all times. ---------------------------------------------------------------------- ms_83 · 2023-11-20 15:18 You have a very narrow view of why certain technologies should or should not be used. I'm not behind CG-NAT but there is still plenty of value to Cloudflare tunnels for me. Even behind my IP I have a fairly complex network environment but CF tunnels make it easy for me to stand up a connection from a cluster, make it resilient and highly available, and automatically handle failure modes to keep the service up to the world. They also give me a transferable configuration that allows me to quickly move my apps to the cloud or to other hosting if I need to. So no, I'm not "mindlessly" using them, I've actually put quite a lot of thought into my architecture and why I used certain technologies, thank you very much. ---------------------------------------------------------------------- readit-on-reddit · 2023-11-20 15:18 No they don't. You don't know what you are talking about. You can turn it on to just route requests to that IP which then gets routed to your home server. I'm using LE certificates that are generated from my reverse proxy in my home. The home servers have the certificates. If you understand how SSL works you would know that you would get a certificate error unless I'm using CF generated certificates which is not required. ---------------------------------------------------------------------- thekrautboy · 2023-11-20 15:18 Thats really not what i meant. ---------------------------------------------------------------------- ElevenNotes · 2023-11-20 15:22 Correct. I don’t trust anyone with my data except myself. Data is tiered. There is data that can be shared freely everywhere and then there is data that should only be accessible by me, and me alone. The same rules of data governance apply in any enterprise. By utilizing the cloud that governance is by default breached, because you have to trust the third party, especially US based companies cannot be trusted (patriot act, cloud act). I’m surprised you are unfamiliar with such simple concepts? In the end, the individual and each enterprise has to decide what they will do, and how far they go. The thousands of private documents that are accessible through unsecured S3 buckets begs the question if enterprises can really do that. The dozens of incidents of data governance’s violation in public clouds adds petrol to the fire. This is **my** opinion, it does not have to reflect nor overlap with yours in any way. You do you, and be happy. ---------------------------------------------------------------------- FallenFromTheLadder · 2023-11-20 15:22 Yes, it's more effective. But you also accept another risk that you wouldn't have in the other case. That's why I told you it. Many other people don't want the MITM that Cloudflare provides. At least not at the ISO 7 level. ---------------------------------------------------------------------- Ok_Antelope_1953 · 2023-11-20 15:25 There is also this: https://blog.cloudflare.com/this-is-brotli-from- origin/ End to end compression of content if you properly setup Brotli at origin and disable some proxy features at Cloudflare. Cloudflare won't decompress your content to apply those optimizations. While compression isn't encryption, it's still a form of obfuscation. ---------------------------------------------------------------------- IM_OK_AMA · 2023-11-20 15:26 Basically turn off all the cloudflare features and us it as a DNS... okay ---------------------------------------------------------------------- readit-on-reddit · 2023-11-20 15:26 > You have a very narrow view of why certain technologies should or should not be used. What you said what objectively false though. You don't need to sacrifice privacy for DDoS protection with CF. > Even behind my IP I have a fairly complex network environment but CF tunnels make it easy for me to stand up a connection from a cluster, make it resilient and highly available, and automatically handle failure modes to keep the service up to the world. What? You can do all that without CF and without sacrificing privacy. If anything, it's less highly available because now CF is a point of failure when you could have handled load balancing at home. > So no, I'm not "mindlessly" using them, I've actually put quite a lot of thought into my architecture and why I used certain technologies, thank you very much. Yet you were wrong about the need to use tunnels for DDoS protection. Plus, if you are not under a CG-NAT, using tunnels just limits your bandwidth for no benefit at all (read the TOS?). Unless you also pay extra and then you are just waisting money. ---------------------------------------------------------------------- spottyPotty · 2023-11-20 15:27 The question was a more general one, and not specific to my personal data needs. The existence of such a ubiquitous centralised service that actually IS a MITM, whether they are malicious or not, seems like a glaring security hole to me. As they say, if the product is free, then you are the product. If people accept, but recognise, a loss of privacy when using free services from Google and meta, for example, knowing that the data they provide is used for personalised ads, then how come CF's free tier isn't viewed with the same level of scrutiny? ---------------------------------------------------------------------- wanze · 2023-11-20 15:28 >I’m surprised you are unfamiliar with such simple concepts? Your arrogance is embarrassing and childish, and not something I'm willing to waste more of my time on. You've clearly shown your hand and it's obvious you don't actually develop or work with software professionally. Also, I suggest you never buy anything online again, because you'll be handing your card number to "your friend's friend". ---------------------------------------------------------------------- ElevenNotes · 2023-11-20 15:30 I tell my thousands of applications I host to stop working immediately, and the software I develop to crash this instant, thanks for the input and the enlightenment which is your person, be it just your online self and not your real self. ---------------------------------------------------------------------- GeekCornerReddit · 2023-11-20 15:34 You realize your computer can have a backdoor put in place by the brand right? Pretty much same deal isn't it? ---------------------------------------------------------------------- Initial-Repeat9146 · 2023-11-20 15:35 OP, what you're describing is not the "big scary MITM" attack vector. It's how TLS/Reverse proxies work. Whether you are using Cloudflare or hosting your own reverse proxy somewhere with full control, it's still terminating TLS at the endpoint and passing back traffic in the clear to the backend. Some people like Cloudflare for whatever reasons, and that's okay. I host my own reverse proxy out on a VPS and it works just fine. You'll find that not all of the seflhosted community is super-focused on privacy as say r/privacy is. ---------------------------------------------------------------------- spottyPotty · 2023-11-20 15:36 nginx can be configured to throttle connections and fail2ban to refuse them to mitigate this ---------------------------------------------------------------------- windows300 · 2023-11-20 15:39 The sites I expose to Cloudflare were already being publicly hosted for my friends. Anything actually private or sensitive I run via private DNS and Wireguard internally. ---------------------------------------------------------------------- ms_83 · 2023-11-20 15:39 >Yet you were wrong about the need to use tunnels for DDoS protection.  Nowhere did I say you "need" to use tunnels to get DDoS protection. What the hell is it with this sub attracting people without basic reading comprehension skills? I also don't know why you're wittering on about privacy, seeing as I haven't said anywhere that it's a particular requirement of mine. In my case it's a public-facing site, I *want* it to be available to the world. ---------------------------------------------------------------------- spottyPotty · 2023-11-20 15:41 To clarify, I did not mean MITM attack. It actually wouldn't make sense to say that cloudflare is a man in the middle attack, since it is a company and not an action. The other commenters understood what I said. ---------------------------------------------------------------------- ItalyPaleAle · 2023-11-20 15:41 Very much unrelated things. The fact itself that the CDN can detect brotli compression means it is decrypting traffic. Compression is not obfuscation in any way and doesn’t provide any security at all ---------------------------------------------------------------------- Nestramutat- · 2023-11-20 15:43 Unless you terminate SSL at the VPS, you can't set the `x-forwarded- for` header. However, if you don't care about seeing the real source IP on your applications, this is correct. ---------------------------------------------------------------------- readit-on-reddit · 2023-11-20 15:48 > Nowhere did I say you "need" to use tunnels to get DDoS protection. You said you use tunnels because they give you DDoS protection. You would know that comment is completely irrelevant and thus you would not make it at all if you understood you could get the same benefit without them. But nice try saving face. > I also don't know why you're wittering on about privacy, seeing as I haven't said anywhere that it's a particular requirement of mine. In my case it's a public-facing site, I *want* it to be available to the world. The user's credentials and anything sensitive that goes through that tunnel is seen by CF. You could otherwise have the same benefits without CF having the ability to snoop your traffic. You let CF snoop because...? Even if you don't care it still makes no sense to me because, again, you can hide your IP and get DDoS protection without CF tunnels. You also didn't address the fact that the tunnels have limitations. The only thing that explains this is the fact that you didn't know you could do this without tunnels. ---------------------------------------------------------------------- Quique1222 · 2023-11-20 15:48 No, this is too late in talking with experience here. You cannot stop a DDoS once it's on your doorstep, that defeats the purpose. You are getting saturated anyway. ---------------------------------------------------------------------- ms_83 · 2023-11-20 15:54 >You said you use tunnels because they give you DDoS protection. No, I didn't. Try reading again what I actually said. >The user's credentials and anything sensitive that goes through that tunnel is seen by CF. What user credentials? Where did I say anywhere that I'm handling user credentials? What "sensitive" things am I handling? You seem to know an awful lot about what I'm doing wrong, even though you have no idea what I'm actually doing. ---------------------------------------------------------------------- readit-on-reddit · 2023-11-20 16:00 Quoting you: > I use Cloudflare tunnels because they are a good way of exposing sites to the internet without exposing my IP or opening ports, which means I don’t have to worry as much about DDoS or other attacks and therefore I don’t need to spend as much effort defending against them. You could get all this without CF tunnels. How will you backpedal now? > What user credentials? Where did I say anywhere that I'm handling user credentials? What "sensitive" things am I handling? It's an example lol ANYTHING you do can get snopped by CF for no benefit at all. Even if you don't care it is still a downside for no benefit at all. I think you get the point by now and if you don't maybe you do need the tunnels after all. Have a good day. ---------------------------------------------------------------------- daywreckerdiesel · 2023-11-20 16:03 It sounds like you think the issue with a man-in-the-middle attack is the MITM part, not the attack. ---------------------------------------------------------------------- I_EAT_THE_RICH · 2023-11-20 16:06 Cloudflare is awesome and undervalued in my opinion. They provide dozens of services and charge extremely reasonable pricing. ---------------------------------------------------------------------- ms_83 · 2023-11-20 16:07 >You could get all this without CF tunnels. How will you backpedal now? Backpedal from what? I didn't say CF was the only option, I just said it's what I used. You know nothing about the other options I looked at and why I rejected them. > think you get the point by now and if you don't maybe you do need the tunnels after all. Have a good day. You have no point because you have no idea. Have a great day yourself! ---------------------------------------------------------------------- zn448sk39 · 2023-11-20 16:12 That's how the they got EncroChat iirc ---------------------------------------------------------------------- discourseur · 2023-11-20 16:36 Oh, in that sense? Sure CF offers a plethora of services. People seem a bit dense though. He was quite obviously talking about what CF brings to the table for self-hosting. Sounds a lot like incompetent people unable to properly configure nginx and use cloudflare don't like to be told there are alternatives. ---------------------------------------------------------------------- WorthyFroglet · 2023-11-20 16:45 Yeah, you can set it to "DNS only", but then you don't get the "protection" that you mentioned. ---------------------------------------------------------------------- agrajag9 · 2023-11-20 16:47 Outsourcing of (some) risk If Cloudflare loses the data and it negatively impacts our brand, we can sue the shit out of them. ---------------------------------------------------------------------- readit-on-reddit · 2023-11-20 16:59 Again, you don't understand how it works. I can use the CF proxy which hides my IP, gives me DDoS protection and all the other benefits without any MITM. The requests reach the CF proxy but the SSL is still terminated at my home server so no MITM is possible. I don't have to set it to DNS only. ---------------------------------------------------------------------- Mailstorm · 2023-11-20 17:01 I'm either reading this wrong or there's a disconnect in knowledge. If you have your own SSL cert and do the termination of that on your end, CF cannot do any MITM without an error on the user's end. However, if your just setting up an a record or whatever to your server that isn't doing ssl termination, then yes they are mitm ---------------------------------------------------------------------- WorthyFroglet · 2023-11-20 17:09 You don't know how it works. SSL terminates at CF, and then CF reencrypts the traffic that terminates at your host with your LE certs. That is how they do "end to end encryption" and is textbook MITM. I'm not saying it's necessarily bad, but it's the way it is. ---------------------------------------------------------------------- allbyoneguy · 2023-11-20 17:20 Yet when you have issues and open a support ticket they can automagically access all resources they want, just by clicking the allow access button... Same with Microsoft. ---------------------------------------------------------------------- readit-on-reddit · 2023-11-20 17:21 That is only true for CF certificates. I already explained that multiple times. Are you reading my replies? My certificates come from LE. The private key is in my server. There is no way for CF to MITM my requests. A proxy does not imply MITM. I am not using the CF certificates at all. You obviously don't know what you don't know. You are describing CF tunnels. ---------------------------------------------------------------------- mattdavis90 · 2023-11-20 17:24 You could run HAProxy with ProxyProtocol to just forward the TCP, then the next HAProxy (running on trusted HW) terminates the SSL and uses the ProxyProtocol IP to set the header for onward services. ---------------------------------------------------------------------- amunak · 2023-11-20 17:27 It's less about you and what you serve to your visitors and more about the people who visit your site. As a user you can protect against most forms of spying, but not if every request goes through a single provider, unencrypted, and hard if not impossible to detect. And you as a service provider behind Cloudflare wouldn't even know about it. Which, like you might not care about. But it's certainly something you should at least think about. ---------------------------------------------------------------------- usernamefindingsucks · 2023-11-20 17:28 I don't think this is true. Even with encryption, the host OS and hypervisor can still read the memory of the guest os/container/cloud whatever. So as long as the guest OS is storing the encryption keys in memory, it will be vulnerable. Unless you can convince the hosting provider to allow you to install your own hardware security module with enough bandwidth to do all encryption/decryption, you still have to trust the provider. ---------------------------------------------------------------------- amunak · 2023-11-20 17:29 As I said in another comment, it's more about your visitors than you. Sure maybe if you have a completely generic blog about cooking or something it doesn't matter much. But still as long as you can use that information (along with information from every other site that user visits through Cloudflare) to infer stuff about that person it becomes kinda scary. ---------------------------------------------------------------------- WorthyFroglet · 2023-11-20 17:33 Bro, if you proxy through Cloudflare, either with Tunnels or DNS with proxy, your traffic gets MITM by CF. It's a tradeoff and it's the entire point of this original post. If you are so confident otherwise, post up your site or app and let's see what certs we get. ---------------------------------------------------------------------- _qqqq · 2023-11-20 17:38 Well that I totally agree with and I don't host anything exposed to the Internet from my house, so we're aligned there. ---------------------------------------------------------------------- mkosmo · 2023-11-20 17:43 Let’s remember that Cloudflare is engaged in business with USG, so if they were doing that kind of nefarious stuff, it’d result in a bad time for a whole lot of folks. ---------------------------------------------------------------------- ListRepresentative32 · 2023-11-20 17:48 they can see as much as my internet provider can see, or is there something else? ---------------------------------------------------------------------- spottyPotty · 2023-11-20 17:56 From my observations, my certificate is used between cloudflare and my server and another cloudflare issued certificate is provided to the client's web-browser. In other words, traffic between the browser and CF servers use a CF certificate, then traffic between CF server and my server use my own certificate. Another way of putting it is that when I host my site directly, the browser reports the certificate as being generated by LetsEncrypt (by me). However, when I add CF to the equation, the browser shows cloudflare as the certificate creator. ---------------------------------------------------------------------- spottyPotty · 2023-11-20 18:03 For me the issue is that, as an entity in middle of communications between a browser and a web-server, (which should be transmitted end- to-end encrypted over https), they get to have access to the unencrypted traffic en-route, undoing the protection that HTTPS was created for in the first place. ---------------------------------------------------------------------- spottyPotty · 2023-11-20 18:06 The question is more general than for personal sites. I'm just highlighting the existence of a privacy/security hole since we all have to trust that CF act honestly and don't provide any backdoor to any government agencies. ---------------------------------------------------------------------- spottyPotty · 2023-11-20 18:09 Maybe it's my fault for posting this in selfhosted. My question was of a more generic nature about security and privacy in general. You're right, r/privacy might be a better sub for this conversation. ---------------------------------------------------------------------- spottyPotty · 2023-11-20 18:11 Yes, agreed. However it's not a centralised service through which a large percentage of traffic passes. ---------------------------------------------------------------------- spottyPotty · 2023-11-20 18:13 I see ---------------------------------------------------------------------- patmorgan235 · 2023-11-20 18:37 Because that's not how certificates work? Your private key is never sent to the CA with you submit a Certificate Signing Request, only the public key and a bunch of metadata. (The exception being code signing certs that are delivered on an HSM but the key never leaves the HSM) ---------------------------------------------------------------------- [deleted] · 2023-11-20 18:51 [removed] ---------------------------------------------------------------------- certuna · 2023-11-20 18:55 Everyone knows the deal, if you don’t like Cloudflare (or any other CDN service) you can always go direct and find ways to deal with the anonymity/DDoS issues yourself. It’s a tradeoff. ---------------------------------------------------------------------- thuhstog · 2023-11-20 19:03 this is a very US centric viewpoint. All the big cloud companies are US based. For the world outside of the US, using the cloud is basically giving a foreign country access to your data. Then theres the tax avoidance they all actively pursue, so the likes of apple, amazon, microsoft, google pay almost no tax in the EU. They contribute little and syphon money from those economies. ---------------------------------------------------------------------- bummyjabbz · 2023-11-20 19:06 All these “omg!!! cloudflare is a mitm!!” Posts are idiotic. That is LITERALLY THE SERVICE THEY ARE PROVIDING. that is almost the ENTIRE POINT of using them. I feel like these posts are made by people who just discovered what MITM is and somehow think they’ve just discovered fire. How do people think tunneling and reverse proxies work? ---------------------------------------------------------------------- spottyPotty · 2023-11-20 19:12 So you agree that the HTTPS reassurance that sites using cloudflare's services provide to end-users is misleading? ---------------------------------------------------------------------- miklcct · 2023-11-20 19:16 So what's the best way to host sensitive contents if you can't trust anyone, for example, you are hosting tools to break a dictator's surveillance? ---------------------------------------------------------------------- schklom · 2023-11-20 19:19 > I could use a VPS instead and run my own proxy, but then I'm trusting the VPS provider. You can pass the encrypted traffic instead of decrypting it on the VPS, then you don't need to trust the VPS provider. ---------------------------------------------------------------------- sysop073 · 2023-11-20 19:21 It's incredible how often an argument is defeated by realizing that using "people" in a sentence twice doesn't mean it's the same group both times. ---------------------------------------------------------------------- ElevenNotes · 2023-11-20 19:24 IPFS, and spread the info via social media that others shall pin your hashes so that everyone can see and access these tools without a central attack vector to block or take down. ---------------------------------------------------------------------- schklom · 2023-11-20 19:25 CF presents their OWN certificate to the client (easy to check). With "Full", they re-encrypt the traffic with your certificate before sending it to you. Regardless which mode you use, they decrypt the traffic with their own certificate. ---------------------------------------------------------------------- schklom · 2023-11-20 19:28 > Even if the data is passing through cloudflare cdn uses the cloudflare certificates my data is encrypted first using my own certificates from the Proxyserver This is false, connect to your website, check the certificate, it will be Cloudlfare's. I assume either you have not checked, or are a Business customer paying quite some money yearly to Cloudflare. Cloudflare decrypts inbound traffic, then re-encrypts it before sending it to you, unless you pay a decent amount of money so that they serve your certificate. ---------------------------------------------------------------------- rad2018 · 2023-11-20 19:56 ...not to mention now using cloud providers in lieu of setting up something at their homes. From someone who deals with "Imperial entanglements" (feds) many times, are any of those who praise Cloudflare with such high expectations going to admit that even Cloudflare - a U.S. owned and headquartered-based company - does NOT fall under the purview of U.S. cyber laws??? ARE YOU GUYS NUTS??!!?? TBH, acquiring even a small number of static IPs doesn't really doesn't cost that much, nor does having a stable energy source (thru a UPS) to have your very own littl' mini lab/data center. I have 4 rack cabinets, 2 telco racks, and a small UPS tray for several UPSs to provide consistently 'clean' power against periodic electrical 'hiccups' (such as power going off for a few seconds). And then there's the matter of accessing your data. Cloudflare has full, unadulterated access - no matter how much they claim your privacy, blah, blah, blah. Does anyone ever read the EULAs? I seriously doubt it. And even if you did, they still have the right to 'sniff' and acquire your data, anonymize your data, and utilize it to sell to other companies - perhaps Google? Perhaps even the Imperium? Here's some more info - your ISP still have access to your data regardless if you host it yourself or not. Even if you've decided to go through Cloudflare; you really don't gain anything. So, for me, using Cloudflare gains me \*nothing\*. ---------------------------------------------------------------------- rad2018 · 2023-11-20 20:02 Also...shouldn't we talking more about self-hosting rather than privacy and efficiency issues? I think the topic is a moot point - either you feel that Cloudflare is 'trustworthy'...or you don't. IMHO, it's sorta like using Google's Gmail for business purposes. Read the fine print - they can do whatever they want with your data, despite their privacy statements. Same goes with Cloudflare. You're using \*their\* services on \*their servers. They have to lookout for themselves and the risks involved. ---------------------------------------------------------------------- t1nk3rz · 2023-11-20 20:08 I checked, and I confirm that the certificate fingerprint is my own? How can cloudflare decrypt my encrypted inbound traffic from my Proxyserver without my certificates,makes no sense? Cloudflare can encrypt and decrypt the traffic but the data is already encrypted when it reaches their CDN no? ---------------------------------------------------------------------- jared252016 · 2023-11-20 20:12 They can see HTTP traffic, not just HTTPS. So: - plain text passwords - auth tokens - images / media - any page content ---------------------------------------------------------------------- binary_flame · 2023-11-20 20:16 There's memory encryption on EPYC CPUs, to allow VPS providers to spin up VMs, but to actually be unable to read/access the memory inside the VMs ---------------------------------------------------------------------- jared252016 · 2023-11-20 20:16 ThePirateBay, the most notorious site in the world, uses Cloudflare. This isn't China. Wiretapping is illegal in most circumstances, and that's essentially what it would be doing. ---------------------------------------------------------------------- jared252016 · 2023-11-20 20:27 Most people don't even lock their computers, and by default Windows logs in as an administrator. Sure there's UAC, but a yes/no can be hit by anyone. Very few people set the proper security recommendations, such as 15 minute lock screens and logging in as a regular user so it prompts for a password. But most people don't have much to hide even if the 3 letter agencies had a warrant to access their PC, which isn't handed out easily. If you are trying to be warrant proof for illegal activity or are at a high risk for hackers (security clearance jobs, I suppose) then it makes sense to be strict on security. Personally, I leave my PCs unlocked all the time, but they're also dumb terminals to the real PCs lurking in virtual machines elsewhere, which do lock. All drives are encrypted. The FBI would have a difficult time and require a specialist to get into my set-up as I use enterprise grade technology. So worst case for me I have to refuse to unlock my PC and sit out the 1 year in jail while they play hardball. ---------------------------------------------------------------------- AlternativeBasis · 2023-11-20 20:40 I use this alternative: * multiple ssh tunnels (running in docker, autossh) from my domestic (and without public IP address) machine to a rented VM, using a ssh key. * Nginx proxy in the VM, with an embedded UI. * DNS form the same provider (cheapest domain, 'something'.xyz) * command line built Let's Encrypt certificate and manually added to nginx. Need change certificates every 3 months. But it's a something delicated, multi step and accident prone built, don't recommend to everyone. Only if you really want understand and control all the process. ---------------------------------------------------------------------- fatalskeptic · 2023-11-20 20:43 wait till you learn about Internet Service Providers... ---------------------------------------------------------------------- jared252016 · 2023-11-20 20:45 That's not the only point of selfhosted. For me I see it like a mobile app, that's centrally located. What I would store on my phone is now on my server, which is better if I lose my phone (theft, technical issues, w/e). Apps just work better for me as progressive web apps and not natively installed applications, and it's how I prefer it. Yes, you risk not being able to access it if the internet goes out and yes it basically requires a sys admin to properly secure it, but it's not just about taking back ownership. I use both, Google and Nextcloud. Both have a copy of everything. I trust Google with my data, always have. Whatever spying going on in the background that occurs has not affected me in 20 years, outside of it initially starting to show search results for gay or pregnant or whatever, which they resolved a long time ago. On top of this, you live with the algorithms. You train them to do what you want and don't let them have data you don't want them to have. Like with incognito, although they're currently being sued for still trying to track you, which is a lawsuit I'm on despite being a loyal customer. Anyway, don't share your devices without multiple user profiles. Android has a "guest" feature to share your phone. Fire stick and basically everything has multiple user profiles. Everyone gets their own algorithm trained. As far as the company and the insights, use paid accounts. My Gmail is paid running on my own domain. ---------------------------------------------------------------------- wanze · 2023-11-20 20:47 >For the world outside of the US, using the cloud is basically giving a foreign country access to your data. That's simply not true. When only using e.g. eu-west-1, GDPR imposes strict rules on the transfer of data to countries outside of the EU. But that really isn't relevant to the discussion about whether handing AWS your data is like "handing your data to your friend's friend". ---------------------------------------------------------------------- -thrun- · 2023-11-20 20:52 Certificates is not safe either. Here you trust providers like Lets encrypt. Most Security comes from the idea that there is one thing you can trust ---------------------------------------------------------------------- chewableplate · 2023-11-20 20:58 State actors also have access to the actual remote servers any cloud software is hosted on directly (think Azure or AWS) along with all of the ISPs and easy access to logs for client devices (especially android). I have very strong opposition to all of that and everything else they have access to but 99% of people trying to maintain a threat-model that high for casual use are missing a mechanism for surveillance they haven't thought of or that is completely undetectable and built into our hardware and software supply chains. The privacy rabbit hole is not for the faint of heart. ---------------------------------------------------------------------- ListRepresentative32 · 2023-11-20 20:59 my comment responds to a comment responding to a comment mentioning a reverse proxy that does not terminate SSL, so these do not apply. ---------------------------------------------------------------------- nemec · 2023-11-20 21:00 Those protection protect from illegitimate access (or to aid in investigating it). If your threat model includes something like law enforcement who may have legitimate reasons to access your data without your consent, there's not much you can do about that. ---------------------------------------------------------------------- jared252016 · 2023-11-20 21:04 Ah, the "parent comment" button makes sense now. Sorry, carry on. ---------------------------------------------------------------------- schklom · 2023-11-20 21:10 > Cloudflare can encrypt and decrypt the traffic but the data is already encrypted when it reaches their CDN no? If you use Cloudflare as a reverse-proxy, they simply serve their own certificate, and yours is used to re-encrypt the traffic from Cloudflare to you (unless you are a business client). My guess is that you use Cloudflare only for DNS (like Namecheap/Godaddy/etc), instead of as a reverse-proxy. Is that the case? ---------------------------------------------------------------------- thuhstog · 2023-11-20 21:21 It's their datacenter, they don't need to physically transfer your data to access it. [https://blogs.microsoft.com/datalaw/our-practices/#does-microsoft- notify-enterprise-customers](https://blogs.microsoft.com/datalaw/our- practices/#does-microsoft-notify-enterprise-customers) >Q: Does Microsoft disclose additional data as a result of the CLOUD Act? A: No. The CLOUD Act amends U.S. law to make clear that law enforcement may compel U.S.-based service providers to disclose data that is in their “possession, custody, or control” regardless of where the data is located. This law, however, does not change any of the legal and privacy protections that previously applied to law enforcement requests for data – and those protections continue to apply. Microsoft adheres to the same principles and customer commitments related to government demands for user data. ---------------------------------------------------------------------- Darkextratoasty · 2023-11-20 21:23 Cf tunnels allow you to expose services without port forwarding, which is just a general nice feature to have. Also, calling anyone who can't set up their own full reverse proxy incompetent is awfully fucking high and mighty of you. Unless you're interested in networking or have experience with it, enabling port forwarding to a reverse proxy has a significantly higher chance of getting mucked up and exposing stuff that shouldn't be than cf tunnels. ---------------------------------------------------------------------- wanze · 2023-11-20 21:23 US law does not apply in the EU. EU law applies in the EU. ---------------------------------------------------------------------- t1nk3rz · 2023-11-20 21:27 Ok i understand, in my case i use cloudflare only for DNS ---------------------------------------------------------------------- spottyPotty · 2023-11-20 21:29 Can you elaborate? I mean, I know that they can track which sites you visit, though this could be alleviated by using third party DNS providers and/or DNS over https. But they can't snoop on the actual traffic if you're using https. Which is kind of the whole starting point of my question regarding cloudflare. ---------------------------------------------------------------------- virtualdxs · 2023-11-20 21:29 How is it misleading? The lock only guarantees that the data is protected in transit between you and the other party, and when the other party is using cloudflare, cloudflare is part of "the other party". Think of it this way, if I'm using [hosting provider] to run my website, then you open my website and see a lock. Yet, [hosting provider] has access to the communications, so isn't the lock misleading? No, because for the purposes of this, the hosting provider is part of "the other party". ---------------------------------------------------------------------- spottyPotty · 2023-11-20 21:34 > a U.S. owned and headquartered-based company - does NOT fall under the purview of U.S. cyber laws > Cloudflare has full, unadulterated access > they still have the right to 'sniff' and acquire your data Thank you, thank you, thank you! That's exactly my point. Most people on here justifying their trustworthiness because everyone trusts them. Like, hello? > your ISP still have access to your data regardless if you host it yourself or not How so? If you're running https? ---------------------------------------------------------------------- nemec · 2023-11-20 21:39 If your threat model includes the U.S. government you are in the very, very, very, very, very minority of the population of selfhosters. ---------------------------------------------------------------------- Mailstorm · 2023-11-20 21:42 I kind of forgot cloudflare needs to be your dns for a domain in order for the CF proxy to work. So yeah..CF can totally mitm the connection so it can just make a certificate on your behalf since it has control of your DNS for validations ---------------------------------------------------------------------- spottyPotty · 2023-11-20 21:44 I say that it is misleading because cloudflare is a mostly transparent service that end-users don't see. The lock gives the impression that ones communications are end-to-end encrypted so that only the sender and receiver can see the contents of what is being transmitted. Having a third party inserted in the middle that can see the contents defeats the purpose, in my view. I do see the point of your second example. ---------------------------------------------------------------------- spottyPotty · 2023-11-20 21:47 That's it ---------------------------------------------------------------------- nemec · 2023-11-20 21:52 > SSL was created to protect data in transit Yes... in transit between you and Cloudflare. If you think it's scary that companies route your traffic through third party servers rather than every company exclusively running their own data centers you should probably just get off the internet entirely. ---------------------------------------------------------------------- virtualdxs · 2023-11-20 21:53 It doesn't defeat the purpose, because the third party is trusted by the first party. The purpose is to protect against eavesdroppers not trusted by either party. Companies use third parties all the time. For example, my doctor's office uses IQ Health, Cerner, Quest, and who knows how many other companies that provide them services they use to provide me their services. Cloudflare is just another subcontractor, so to speak. ---------------------------------------------------------------------- Initial-Repeat9146 · 2023-11-20 21:55 > Maybe it's my fault for posting this in selfhosted. My question was of a more generic nature about security and privacy in general. You're right, r/privacy might be a better sub for this conversation. > > In my case my reverse proxy (nginx) runs on the same machine as my backend. In fact nginx also serves all static data with the backend only serving api requests. No worries, it's just not a useful post for this group, most know the "risks" :-) ---------------------------------------------------------------------- rad2018 · 2023-11-20 22:11 A ISP can determine your domain names accessed, along with source and destination IPs. An encrypted connection with the host is initiated before any data is exchanged between the source and destination. For example, let's say you visit a secured web site. Here’s what happens: 1. The URL is resolved to a host address (and port, if present). 2. A connection with the host is initiated. 3. The certificate of the server is checked. 4. Client and server exchange encryption keys. 5. Client sends an (encrypted) HTTP request. 6. Server replies with an (encrypted) HTTP response. Quite a number of HTTPS URLs are relative to pages which contain non- HTTPS elements (such as images). Those elements are visible. The presence of non-secure elements in the page is usually notified in the browser (with a broken lock, for example). Also, an improperly configured website that starts with the unsecured-HTTP URL then transfers to an HTTPS URL is subject to possible scrutiny. And even if you use a VPN service, that service provider will still have your data packet information. Basically, there is no place safe anywhere on the Internet. ---------------------------------------------------------------------- travellingtechie · 2023-11-20 22:14 Do login credentials traverse cloudflare? I havent used cloudflare so I dont know much about it, but I wouldnt want my credentials for self hosted sites to pass through a MITM. ---------------------------------------------------------------------- ppciskindofabigdeal · 2023-11-20 22:17 Almost makes you wonder what their business model is hey.... ---------------------------------------------------------------------- thil3000 · 2023-11-20 22:18 Even more technically since they own the hardware they could see everything happening in and out of the vm, but if you use it as a cf replacement you’d only use it for network so yeah kinda like your isp for that use ---------------------------------------------------------------------- kindrudekid · 2023-11-20 22:20 There is MITM that’s there to sniff on you and find dirt.. And there is MITM that is doing stuff for scale, security etc… If you look at it the NGNIX proxy is a MITM. A lot goes into this. Companies also have reputation to uphold. Plus data is not stored company name endpoint , its obfuscated with UUIDs ---------------------------------------------------------------------- maevian · 2023-11-20 22:32 How are they going to prevent an opensource browser like Firefox to do this? Scary stuff ---------------------------------------------------------------------- Candle1ight · 2023-11-20 22:37 I don't use them, but I can also recognize my feelings are really just paranoia. All of my data is inconceivably small compared to what they can look at if they wanted to, and the idea that they would risk their entire company on me is laughable. ---------------------------------------------------------------------- IonTichy · 2023-11-20 22:51 > If I was from some 3 letter agency and want to spy on potential illegal content, I would tap into a vpn server. Or simply fund one and advertise it on youtube. ---------------------------------------------------------------------- mfenniak · 2023-11-20 22:52 If you use Cloudflare, then the answer is almost always yes. There are challenge-response mechanisms that some applications can use to avoid credentials being sent on the wire, but it is much more common for an application to rely on the transport-level security that TLS provides (and that Cloudflare intentionally intercepts in a trusted way) to provide security. ---------------------------------------------------------------------- maevian · 2023-11-20 22:53 Do you actually work IT in an non US country, because I do and still most firms are using cloud technology. ---------------------------------------------------------------------- malastare- · 2023-11-20 22:53 How do you know that your certificate issuer is not collaborating with your ISP to decrypt all of your traffic? How do you know that your CA isn't selling your cert to another MITM who could steal/snoop your traffic? How do you know that your ISP isn't MITMing all your your HTTPS right now? I'm not trying to say that you should give up and trust everyone. Or that you're not being objective or logical about this. What I'll try to get to as a message is this: To achieve some goals, you need to trust someone. And you should evaluate that trust based on objective, realistic analysis, rather than treating all gaps as canyons. **The purpose of Cloudflare is to be a MITM**. It's seriously their business model. By the way, it's also the point of a firewall... and a DMZ... and a CDN... and a reverse proxy. The internet is filled with MITMs. And Cloudflare is a MITM for all the same reasons as the firewall, DMZ, CDN, and reverse proxy. Any time it operates in that mode, it *must* decrypt the connection, because the basis of HTTPS is to only allow decryption by the destination, and in order to do all the other stuff it has to do, it needs to be the destination. **What's the risk?** Imagine they are decrypting the data. Do you honestly expect them to store it? Do you think that would be a secret they could keep? If they were storing it, what would they use it for? How? What value do you think they would get from it that is worth all the effort, hardware, and time? I realize this is the weakest counter- argument, but it's worth taking the time to really talk through it. I worked at a hosting company with a million or so customers. All the traffic from the stateful firewall to the server racks was HTTP. I could look at all of it. The reality of the situation is that we spent a bunch of time trying to optimize network traffic and server configs just trying to reduce the impact of logging simple connection events. The idea of trying to capture general traffic in some sort of datastore for continuous data mining across the population of customers was a joke that we repeatedly made. **Better yet, what's the alternative?** Since HTTPS is designed to prevent decryption or modification in the middle of the stream, the only way to run a fully encrypted stream from one endpoint to the other is to let all remote endpoints know exactly where they are sending information. That information lets them know who to attack, what location they are at, and potentially various other info about the serving infrastructure. I can put up a firewall, but even with crowdsec and dedicated stateful inspection firewall hardware, I need a decent amount of effort to keep up to date on attacks and adjust rules. **The tradeoff is important**. I know that Cloudflare can read my data. I know that my data is worth far, far less than the hardware Cloudflare would need to capture and mine it. I also know that with a Cloudflare tunnel up, anyone connecting to those services doesn't get to see where my actual server is hosted. They don't even know how many locations I'm hosting from. If they want to attack me, they have to attack through Cloudflare. They have to use patterns that Cloudflare hasn't prevented. They have to avoid having their IP classified as nefarious based on the traffic that Cloudflare has seen. The level of protection Cloudflare provides is far more valuable (to me) than the very low risk of them suddenly deciding that my traffic might be super interesting. If your primary goal is a private tunnel, then you should probably think of a self-hosted VPN. Cloudflare is supposed to be a MITM, and its supposed to isolate you from the rest of the internet in a way that leverages your trust against Cloudflare's ability to protect and abstract your hosting environment. ---------------------------------------------------------------------- VikingFjorden · 2023-11-20 22:55 Probably because they know that popularity doesn't equal correctness. The take you're responding to is comically uneducated. It's only popular among people who have no relevant experience or knowledge in the slightest, everybody else recognizes that it's unadultered dogwater. ---------------------------------------------------------------------- benjiro3000 · 2023-11-20 23:01 Somebody really need to read up how Cloud flare works with SSL certificates. Any requests goes to cloud flare their servers (their certificate) and then they proxy that requests to your server (your certificate). They see every request. When you send data back, they READ your data (as their proxy is the end client), and then forward it to the actual client. Client Proxy (CF) You They do NOT do encrypted proxying, from you to the client without decoding. Its written everywhere in their documentation. Aka, CloudFlare can and DOES read every piece of data you send, and clients send to you. If they want too, they know what message you send to your girlfriend, what your ordering, what your clients are doing on your website. ---------------------------------------------------------------------- benjiro3000 · 2023-11-20 23:10 > Uhm i dont know, selfhosting? Great, you can fix up my DS Lite tunnel ISP... O wait, rent a online server to act as proxy? Weeeel, good luck getting that connection to work. Trust me when i say i wasted easily days, to go freaking nowhere trying to setup WireGuard Router Online Server or Wireguard Server <> Online Server Its so easy they say... Freaking 30 years doing IT jobs, inc server management and i was pulling my hair out trying to get it working. Its always easy for others but if your config is a bit off compared to any online tutorial, well, your fucked because boy are error very "intuitive". Cloudflare ... barely 5 minutes to setup and zero cost. Guess what people will pick? ---------------------------------------------------------------------- thuhstog · 2023-11-20 23:23 Tell that to Kim dot com. ---------------------------------------------------------------------- thuhstog · 2023-11-20 23:25 lol of course they do, thats why the tax avoidance is a problem. I'm not disputing that at all. I am pointing out one of the downsides to it. ---------------------------------------------------------------------- usernamefindingsucks · 2023-11-20 23:54 Well, thanks that is very interesting. https://www.amd.com/content/dam/amd/en/documents/epyc-business- docs/white-papers/cloud-security-epyc-hardware-memory-encryption.pdf ---------------------------------------------------------------------- Stewge · 2023-11-21 00:15 The actual danger with CA trust is that the CA *could* issue a completely new certificate with basically any domain name and every browser in the world will think it's legitimate. You are trusting them not to do this. ---------------------------------------------------------------------- SadMaverick · 2023-11-21 00:47 Well. What you are saying is actually not the spirit of the sub. Why do you always assume everyone is at the same level? For beginners who just want their website exposed to the outside world, Cloudflare/tunnels are an excellent option. If they have enough knowledge, they can chose to do something different. What would you say to someone who’s trying to self-host email? General sub recommendation is don’t do it. ---------------------------------------------------------------------- SadMaverick · 2023-11-21 00:53 My take is: Any data worth your while shouldn’t just rely on HTTPs anyway. You should have more layers of encryption. That’s how majority of the companies do it. And for people who do not even know this, are better off using CF as MITM. ---------------------------------------------------------------------- hmoff · 2023-11-21 00:53 How will the TLS-terminating proxy know the real source IP? ---------------------------------------------------------------------- [deleted] · 2023-11-21 01:00 [deleted] ---------------------------------------------------------------------- thekrautboy · 2023-11-21 01:28 *yawn* ---------------------------------------------------------------------- mattdavis90 · 2023-11-21 01:44 Using the proxy protocol: https://www.haproxy.com/blog/use-the-proxy- protocol-to-preserve-a-clients-ip-address ---------------------------------------------------------------------- rfctksSparkle · 2023-11-21 02:05 >How do you know that your certificate issuer is not collaborating with your ISP to decrypt all of your traffic? How do you know that your CA isn't selling your cert to another MITM who could steal/snoop your traffic? How do you know that your ISP isn't MITMing all your your HTTPS right now? Not if you depend on tunnels to get through cgnat. ---------------------------------------------------------------------- rnmkrmn · 2023-11-21 02:33 They can even see what's in your RAM. ---------------------------------------------------------------------- s3r3ng · 2023-11-21 03:28 Yeah. I believe Cloudflare basically has its heart in the right place but it is is still a dangerous central choke point. ---------------------------------------------------------------------- ListRepresentative32 · 2023-11-21 03:44 read the comment chain again please ---------------------------------------------------------------------- Bladelink · 2023-11-21 03:51 Wow, that's so offensive to our people. Unbelievable. ^^^/s ---------------------------------------------------------------------- malastare- · 2023-11-21 04:00 >Hell, just the server logs (timestamps, IP addresses and exact URLs) would be unbelievably valuable. People say that, but the actual data would be so vast and with so little actual usability, that the dilution of it still results in largely garbage data. Its only when you have a particular focus and have the ability to filter to that focus that the data becomes very valuable. Even banks and card processors, who have direct, legal, and completely open access to data as critical as where every one of their customers spends money struggle to do more than harvest aggregated usage patterns. The idea that data volumes, at a couple more orders of magnitude and notably more generalized will be easily processed and harvested ends up being pretty silly. ---------------------------------------------------------------------- gwicksted · 2023-11-21 04:37 This. It’s basically the same as a load balancer doing ssl termination in a cloud environment. Sure, doing this all self-hosted could potentially be higher security … but it’s not a lowendbox vm lol ---------------------------------------------------------------------- malastare- · 2023-11-21 04:51 >Plenty of options to host things like that yourself. Plenty of ways for people to run their own DNS or run their own email server or even act as their own CA, yet people here repeatedly and consistently advocate that people not host those themselves (yes, I know there are people who do handle their own externally-exposed DNS, I was one of them, but it's also a service that can break quite a bit with a simple hiccup). Similarly, lots of people choose not to host the infrastructure that provides isolation/abstraction of their home networks. Or... for those people running small businesses, they want a better DDoS mitigation solution than they could buy/run with their ISP. So, its not so different from running your own SMTP. I've done it. I know how, but it's obnoxious to do it from even a business-class ISP and I gain value from the trust the rest of the world has by using a common intermediary (any of the email hosts that are willing to act as an MX target). You *can* do it yourself, but it's not wrong to choose to have someone else do it. ---------------------------------------------------------------------- ElevenNotes · 2023-11-21 04:51 I thought wireless keyboards are? ---------------------------------------------------------------------- aeroverra · 2023-11-21 05:37 Most companies do the same thing with Amazon or Microsoft but imho Cloudflare provides a much cleaner, easier to use, cheaper and overall better alternative. ---------------------------------------------------------------------- hmoff · 2023-11-21 06:45 Thanks ---------------------------------------------------------------------- manawenuz · 2023-11-21 07:20 It comes down to the same line of reasoning that most people are "OK" with using cloud, be it aws, google, oracle, microsoft etc .. Out of laziness and lack of expertise, basically sysadmins are dead. Otherwise it's always a bad idea to offload anything on a third-party specially without transparency (pinky promise) Badger DAO lost 120M, to this pinky trust. https://www.theblock.co/post/126072/defi-protocol-badgerdao-exploited- for-120-million-in-front-end-attack Same issue however exists wirh domain name registerers, etc, hence even such a thing as ens.domains are much more trustworthy, and it's much harder to exploit. ---------------------------------------------------------------------- lilolalu · 2023-11-21 07:23 >security i think you are completely wrong here. big corporations do cost assessments of security vs costs of security breaches. if security is more expensive than data breach, they will accept the breach. ---------------------------------------------------------------------- manawenuz · 2023-11-21 07:27 Rented vps, is at tad more safe than cloudflare, the host can basically have access to your vps memory, hence your private keys are exposed and at the mercy of the provider, they also simply control your network equipments, hence they can intercept your traffic anyhow they want, they can even forge a reply to your nodes, etc ... I'd say as powerful as cf for that purpose. You need to own your keys, ns records , registerer rights, ip address and definitely your hardware, otherwise your level of security is not optimal. ---------------------------------------------------------------------- saxobroko · 2023-11-21 07:31 Yes by default traffic is only encrypted between cloudflare and users, but you can set it to “full (strict)” and have it end to end encrypted ---------------------------------------------------------------------- spottyPotty · 2023-11-21 07:32 > You trust your employer, don't you friend citizen? This is exactly the original point I was trying to make regarding cloudflare. The point that i take from this tongue-in-cheek sentence of yours is that no, we should absolutely not trust our employer with our unencrypted traffic. But then on the other hand there are loads of people on here saying that, yes, of course we should trust cloudflare with having access to all of the data flowing through it. ---------------------------------------------------------------------- spottyPotty · 2023-11-21 07:36 > Because it's "everyone's MITM" it would make it a perfect spot for state actors to tap into in order to surveil pretty much everything without anyone being able to notice. Yep, that's my main point ---------------------------------------------------------------------- spottyPotty · 2023-11-21 07:40 That's exactly my point. Thank you ---------------------------------------------------------------------- Emiroda · 2023-11-21 08:28 Are you by any chance American? Getting hit by a GDPR/NIS2 fine on top of a data breach hurts. ---------------------------------------------------------------------- DeviousBeevious · 2023-11-21 08:38 I agree you need some trust that they are not tampering with the HSM but provided that is the case, they cannot otherwise spy on the VM. https://www.amd.com/en/developer/sev.html ---------------------------------------------------------------------- DeviousBeevious · 2023-11-21 08:39 but its audited and tracked. its less of a problem that they access as long as it can't be done quietly. ---------------------------------------------------------------------- amunak · 2023-11-21 08:53 Right, but it's not necessary only about that; if you care about other people and/or you don't want to give the US and their spy agencies more power - perhaps if they are opposed to what they do and the idea of mass surveillance in general (and that's even if it doesn't affect you directly, which is most likely the case) this is a pretty simple way to make sure that you aren't contributing to it. It's like with, I dunno, consumerism. If you don't like it, just don't do it since it opposes your views anyway. And sure your impact will be pretty small but it's still easy to do and it's kind of a win-win situation? ---------------------------------------------------------------------- amunak · 2023-11-21 08:58 Wiretapping is only illegal if it isn't sanctioned in some way. They can spy on anyone who isn't an American citizen legally, so they could probably tap into any server that's outside the US. They can also spy on people if a secret court allows them to do so, and (by design) you would never even know about it. Lastly they can simply have deals with agencies from other countries that have similar "restrictions" where they tap into the US data and then they just exchange the collected data, because then it's technically not them who is doing it so it's perfectly legal. They certainly have no obligation (or desire) to keep anyone's data private - especially from themselves. > ThePirateBay, the most notorious site in the world, uses Cloudflare. It wouldn't be far fetched to think that now that the battle against it was lost on all fronts it would work as a good honeypot. You never know what or who is behind it. ---------------------------------------------------------------------- amunak · 2023-11-21 09:01 Well yeah, it's not easy. Which is why they limit what they do to the aggregated data or to targeted discovery. But that's only a small technical hurdle and the speed with which you can analyze the data grows much faster than the volume (especially if you are smart about what data you analyze and how you do it) so it won't last forever. ---------------------------------------------------------------------- Cypher_Dragon · 2023-11-21 09:25 The web as a whole relies on trust - that's the entire basis of the SSL protocol to begin with. There's implied trust with the big CAs on the internet, because without some trusted 3rd party, you would have to import the certificates from each company you want to do business with, and you would still have to trust _them_ to properly handle and manage their certificates, and especially their CA, correctly. It would become a giant mess, and have a _lot_ more vulnerability overall than the current model. There's trust with your ISP not doing shenanagans with your data over their network. There's trust that whomever you bought your computer from hasn't installed some clandestine firmware...and it doesn't matter if you built your PC, as the component manufacturers could also be doing things at the hardware level (this is the basis the US government used to ban new Huawei and ZTE devices from being sold in the US). At the same time, your points are absolutely valid - you're having to trust yet another 3rd party is handling their certificates and security properly, haven't been compromised by malicious actors (or the various government powers...which we all know can and has happened), and is handling your data in appropriate ways. CloudFlare has a vested commercial interest in protecting the data that flows through their servers - not just from a regulatory compliance angle, but just from straight business logic. If they're found to not be following best practices and allowing data to be accessed on their network that should be encrypted, AND there was a large enough public outcry to make businesses using CF worried about losing revenue, then CF's customers would drop them in a heartbeat. CF isn't the only CDN/DOS protection provider out there. That provides pretty solid reasons for CF to actually implement security best practices, and to do their best to protect your data flowing through their network. At the end of the day, the web is built on layers and layers of trust. Even with "zero trust" being one of the latest security buzzwords to be spread around, there is a trust relationship at some point in the background. You have to perform your own risk analysis and look at what threat actors would be interested in your own personal data. For most of us, our data isn't important enough to draw the attention of the high-level actors that would be able to compromise CF at the level needed to be sure that any data of interest is actually captured reliably. It's far more likely our data would be caught up in a wide dragnet, analyzed, and then discarded for not being "interesting" (unless, of course, you're doing things that _would_ draw the attention of the various TLAs around the world...then all bets are off). CF processes too much data regularly for them to target any one person's data without some reason to. This is one of the cases where having a lot of companies using this provider is actually a good thing, because the sheer amount of data they process prevents them from targeting an individual without good cause. Is it a perfect solution? Not by any means...but it's also a situation that's nearly impossible to avoid. You can try and only do business with companies that don't use CF or similar CDN/proxy services, but you'll likely find that to be an ever-shrinking list...and you'll also likely find that they use some other technology provider, like AWS or GC, that you might find distasteful as well. Using the modern web means making compromises. Only you can really determine what your threat model is, and how concerned you need to be about these 3rd party and middleware providers. In general, most people have found the trade-off of a little bit of security is worth it for the advantages the use of CDNs like CF provide. ---------------------------------------------------------------------- allbyoneguy · 2023-11-21 11:49 Same with Cloudflare, you trust a third party to do auditing etc ---------------------------------------------------------------------- DeviousBeevious · 2023-11-21 11:50 yeah I have no issue with cloudflare. ---------------------------------------------------------------------- malastare- · 2023-11-21 12:22 >But that's only a small technical hurdle and the speed with which you can analyze the data grows much faster than the volume (especially if you are smart about what data you analyze and how you do it) so it won't last forever. In 10 years, we've made such slow progress on conquering that "small technical hurdle" that it's hard to take the argument seriously. Generative AI data ingestion techniques are the first round of technology that come close to being able to target the data volume/complexity we'd see in it, and those ingestion techniques are still: * Very expensive * Time consuming * Produce datastores with largely unusable data for the general purpose And the techniques that pull data from them don't end up saying more than what you could have gotten from a directed observation. You need to know what you're looking for to get it, or you'd need to code particular ingestion techniques to be able to extract the patterns you wanted to scan for. So, the end result is still the same: Your concern is over a directed attempt to wiretap you, and if that is your concern, then there are a bunch of other places you need to be concerned with. Also, if your primary concern is the number of people/agencies that might be trying to wiretap you, then I'd probably agree that Cloudflare is not for you. Maybe some sort of Tor connection via an array of cellular antennae? ---------------------------------------------------------------------- spottyPotty · 2023-11-21 12:44 Thank you for your well balanced response. I suppose that I have a hard time accepting that the situation is hopeless and we have no choice but to accept such compromises at practically every layer of our communications. ---------------------------------------------------------------------- TheQuantumPhysicist · 2023-11-21 13:21 The concern isn't that CF is reading your data. It's that 3-letter agencies can read your data at will, since they always make these deals with large companies to have open-hose access to all the data. There was a scandal that Facebook had a special access page for those people. You might think you're innocent, and you're a good person, so nothing to worry about. This is the old "I have nothing to hide", but this isn't how the world works. People who want to get you can pull strings to get anything they want from government institutions. After all, government is just people. It's not a benevolent being. Now all this is unlikely, granted. But the task of a good security setup isn't to make it impossible to hack you, but it's to make it **hard enough and costly**. I'm quite sure there's a zero-day somewhere that can hack my bare-bones Linux servers, but good luck breaking the 10 layers of security I have before even reaching these servers to find something remotely valuable about me. I don't need to make concessions in that regard. You don't have to trust anyone. ---------------------------------------------------------------------- TheQuantumPhysicist · 2023-11-21 13:25 Don't even get me started... I just made a huge comment about the clown-nature of this thought-process. I think it all boils down to experience. Some people need time to understand how to make their systems secure (including myself). It took me years of experience to learn how to raise all defenses to ensure security in all my self-hosts. ---------------------------------------------------------------------- usernamefindingsucks · 2023-11-21 18:53 Can we all say, whoops that was disabled in bios. ---------------------------------------------------------------------- Cypher_Dragon · 2023-11-22 05:53 Security in practice is always going to be a compromise. A friend of mine liked to use the metaphor that you have a dial - on one side is usability, on the other is security. As you turn one up, you turn the other down. The trick is finding that sweet spot in the middle where you have adequate security, while also not being a detriment to usability to the point that users will bypass all security because of the impacts. As an example of this idea, let's look at passwords. Longer, more complex passwords are more secure (generally, there are some caveats that I'm glossing over for simplicity's sake) because it takes longer for an adversary to crack the password. So in the interests of security, we set a minimum password length in policy. We also force users to include the standard complexity enhancers of a capital letter, a lowercase letter, a number, and/or a symbol, and your password has to have at least 3 of those. Also, let's assume we're operating on old advice, so we tell everyone that they have to change their passwords every 90 days. In this case, if we set the policy to require a password that's "too long," users won't be able to remember them, so they're going to write them down. Now, that complex password policy has gone from being very strong on paper, to worthless in practice, because everyone just writes down their password and sticks it some place close to their keyboard, so they can just look at the paper instead of trying to remember some long, complicated "word." The trick in this example would be to find a password length that users are able to memorize easily, while being long enough to discourage/prevent _most_ cracking attacks. You have to find the compromise. These kinds of compromises are all over cybersecurity, including on which entities you choose to trust your data to, and what services you choose to use. ---------------------------------------------------------------------- danychouinard · 2023-11-22 10:26 Yes. This means they can see your native encrypted self-signed traffic. Which does not do much. Unless you expose unsecured content to the internet. Please don't. ---------------------------------------------------------------------- teem · 2023-11-23 12:52 Well they should at least. :) ---------------------------------------------------------------------- WisdomSky · 2023-11-28 02:05 No. you certainly didn't read it properly duh! So again... get a reading comprehension and educate yourself. MITM can be used as-is. and MITM does not automatically translate to MITM Attack. As I said, MITM in this case only means "middle man" and nothing else. 🙄🙄🙄