• Dessalines
    link
    fedilink
    32 years ago

    Its a man in the middle that recieves every communication to any server that uses it, including ip addresses, signups, passwords, usernames, all in clear text for them. Since so many servers use it, its a giant aggregator as dangerous as a centralized password store.

    • CarrotsHaveEars
      link
      fedilink
      12 years ago

      Just wanna add that it’s impossible for them to have your encrypted messages if you use an HTTPS certificate from another CA.

      • @AgreeableLandscape@lemmy.ml
        link
        fedilink
        2
        edit-2
        2 years ago

        Meta analysis of encrypted traffic is more powerful than you think. By analyzing things like the length and timing of requests and responses, researchers have been able to determine what search term a user typed, what images and videos are being viewed, which threads on a forum they accessed, among other things, without ever decrypting the HTTPS data.

    • TmpodMA
      link
      12 years ago

      I use Cloudflare solely for DNS management because I know of other alternative that is remotely close to it… Registrars are usually really awful. I never proxy A records, always pure DNS.

      Quad9 is a great alternative to CF’s 1.1.1.1, but unfortunately they don’t provide a service like that :c

      • Kinetix
        link
        fedilink
        02 years ago

        I am guessing you aren’t running any servers anywhere you could do your DNS on?

        • TmpodMA
          link
          12 years ago

          Never considered that as a serious option. What kind of DNS server software would you recommend? What resource footprint does it have (my server is already pretty crowded and I’d like to not get a new one for now)? Does it work well?

          • Kinetix
            link
            fedilink
            02 years ago

            Works as flawlessly as anything, but I’d recommend two systems, you want to have at least 2 DNS servers. If two small VPSes doesn’t make sense for you (you hardly need any resources to run powerDNS or BIND), then I wouldn’t go with that option. Was just curious.

            • TmpodMA
              link
              12 years ago

              Yeah, I just read a bit on the topic too and I came across the same thing. Atm I don’t run anything that would justify getting two servers for DNS, so I’d rather rely on a third-party. Thanks for the suggestion though and if you have any good alternatives to CF please let me know :)

              • Kinetix
                link
                fedilink
                02 years ago

                Well, I would be loathed to give CF money or data, so since I own domains at a registrar that does “meh, OK” services, if I wasn’t running my own DNS servers I’d just go with them. I would most registrars would provide reasonable DNS services for nothing.

                I use Netfirms, btw, but that’s not necessarily a plug for them.

                • TmpodMA
                  link
                  12 years ago

                  I see. Yeah, I haven’t had the greatest of experiences with my registrars when it comes to DNS (mainly slow updates and inability to add some types of records). Also, I don’t give CF money nor data really, I use just DNS, no proxying. The distributed nature of DNS makes CF less prone to getting data than it would be otherwise. Do you know any other service similar to CF’s DNS thing?

  • @AgreeableLandscape@lemmy.ml
    link
    fedilink
    22 years ago

    Lots of good answers already, but I haven’t seen anyone talk about this: Sites “secured” by CloudFlare are almost impossible to use with Tor, some VPNs, or even simply with JavaScript disabled. Their Captcha page that pops up when you use any of these tends to be broken and just redirects back to itself even when you clear the captcha, instead of actually showing you the page itself (and the redirection is happening server side, so there’s also nothing you can change in the URL to get you to the right page).

  • m-p{3}
    link
    fedilink
    0
    edit-2
    2 years ago

    It’s not hate against CloudFlare itself, but mostly against the centralization and siloing of private services that are incrusting themselves at the core of the Internet.

    • @AgreeableLandscape@lemmy.ml
      link
      fedilink
      02 years ago

      No, it’s hate against the company (in addition to what you said). CloudFlare has done many dodgy things in the past and are absolutely not trustworthy.

      • m-p{3}
        link
        fedilink
        02 years ago

        Do you mind enumerating some of these dodgy things?

  • @TheAnonymouseJoker@lemmy.ml
    link
    fedilink
    -32 years ago

    Someone’s comment who I know:


    CEO of CloudFlare once said:

    Matthew: Back in 2003, Lee Holloway and I started Project Honey Pot as an open-source project to track online fraud and abuse. The Project allowed anyone with a website to install a piece of code and track hackers and spammers.

    We ran it as a hobby and didn’t think much about it until, in 2008, the Department of Homeland Security called and said, “Do you have any idea how valuable the data you have is?” That started us thinking about how we could effectively deploy the data from Project Honey Pot, as well as other sources, in order to protect websites online. That turned into the initial impetus for CloudFlare.

    (Source)

    BBC reporter Zoe Kleinman wrote that Matthew Prince wanted $20,000 for the Honey Pot data. “That check showed up so fast,” said Prince. Michelle Zatlyn heard the story from Prince and replied, “If they’ll pay for it, other people will pay for it.” Soon she and Prince cofounded CloudFlare.

    From an article:

    Swearing off data collection

    But wait, if Cloudflare is directing your website queries, then can’t it collect your browsing history for itself? Actually, they’re not going to keep that data at all, Prince said.

    “At no time will we record the list of where everyone is going online,” Prince said. “That’s creepy.”

    Cloudflare is working with third-party auditors at KPMG to examine their systems and guarantee they’re not actually collecting your data. That privacy commitment, Prince said, is what separates Cloudflare’s 1.1.1.1 from other DNS services that are free and open to the public.

    […]

    Cloudflare’s promise to keep your data private is impressive, said Heidi Shey, a privacy and security expert at business analyst firm Forrester. “It’s a great thing that they’re coming out of the gate and being up front about that,” Shey said. Still, she added, “You’re kind of taking what they’re saying at face value.”

    The company will need to continue to be transparent, showing what the auditors find in their logs, for consumers to continue to trust the service, Shey said.

    (Source)

    Concerning KPMG, “the well-respected auditing firm” as Cloudlfare puts it. Really?

    Hmm… so much for “put our money where our mouth was” (source), interesting choice Cloudflare!

    The gist of this is: DHS saying there is valuable data of those collections, hence the initial impetus for CloudFlare after having $20,000 from their Project Honey Pot! My question would rather be, who’s operating those DNS providers and who’s watching the watchers? Because, DNS queries can reveal a lot about a persons internet activity and usage. There is an interesting research about DNS on the topic of user privacy, though the research is about Tor and DNS (and thankfully Tor is still safe as they said that they “don’t believe that there is any immediate cause for concern.”), the researchers said:

    We show how an attacker can use DNS requests to mount highly precise website fingerprinting attacks: Mapping DNS traffic to websites is highly accurate even with simple techniques, and correlating the observed websites with a website fingerprinting attack greatly improves the precision when monitoring relatively unpopular websites.

    So, just like the internet is plagued with Google Analytics and other of their subsidiaries. We are then now plagued more by CloudFlare with their CDN and DNS.

    Relevant:

    Concerning DNS over HTTPS (DoH), internetsociety.org noted:

    [RFC8484] specifies how to send and receive DNS queries over HTTPS. Server configuration is performed out of band, and the connection with the resolver is secured as any other HTTPS traffic. DoH is mostly targeted at web browsers and does not have the potential for improving the privacy properties of transactions between recursive resolvers and authoritative nameservers.

    What people should understand as noted by internetsociety.org’s document concerning encrypted DNS is: the mechanisms should be seen as ways to improve, in specific scenarios, certain aspects of network privacy, but not as replacements for other privacy mechanisms such as VPNs or other implementations such as Tor.