Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A public letter to CloudFlare to fix their snoopy vendor

github.com

Post reply on HN
Print view View original

81–90 of 117 posts

Re: A public letter to CloudFlare to fix their snoopy vendor

#81

Post by btown »

r1ch wrote: post #11

Glad to see this getting attention. Flexible SSL is an awful option that has no place in the modern encrypted web. Out of the four SSL options Cloudflare gives users, only one is actually secure. It's a huge foot-gun.

On the contrary, the idea that a mom-and-pop shop running an HTTP website on some ancient shared hosting can easily just drop in Cloudflare is a Good Thing. Sure, you're not removing the attack surface, a state actor could intercept the server-to-server connections... but at least the hacked router in your customers' coffee shop is removed from the threat model. You make it any tougher, and that HTTP website is just going to stay HTTP forever.

Re: A public letter to CloudFlare to fix their snoopy vendor

#83

Post by gh123man »

creeble wrote: post #74
Aulig wrote: post #72

Earlier quoted context omitted.

Exactly, I've been doing this with letsencrypt.

How do you get certbot to work? Or do you renew manually or something?

I just went though this. you need to whitelist the acme-challenge (using page rules) like this:

  *example.com/.well-known/acme-challenge/*
  Disable Security, SSL: Off, Cache Level: Bypass, Automatic HTTPS Rewrites: Off
and one big gotcha:

  Under SSL/TLS -> Edge Certificates -> disable Always Use HTTPS
(assuming you are using the HTTP-01 challenge).

Re: A public letter to CloudFlare to fix their snoopy vendor

#85

Post by Matt3o12_ »

creeble wrote: post #74
Aulig wrote: post #72

Earlier quoted context omitted.

Exactly, I've been doing this with letsencrypt.

How do you get certbot to work? Or do you renew manually or something?

Getting it to work the first time was a pain. Basically, you want to disable cloudflare (just untick the box so that it goes directly to your server, you can keep using cloudflare's dns server), then obtain the normal way, and reactivate Cloudflare. But I would highly recommend using cerbot's cloduflare dns plugin[1] instead so that you can (re)create the certificate w/o disabling cloudflare.

1: https://certbot-dns-cloudflare.readthedocs.io/en/latest/

Re: A public letter to CloudFlare to fix their snoopy vendor

#86

Post by sangeeth96 »

throwaway888abc wrote: post #82

Cloudflare is not doing anything wrong, why to pick that call ? Airtel support is here https://www.airtel.in/contact-us Also, vote with your wallet and don't use Airtel ?

Oh but they are. They chose Airtel in their locations. I'm using BSNL as my ISP but my request goes to one of these locations that seems to be using Airtel and I get the same DoT block message.

Re: A public letter to CloudFlare to fix their snoopy vendor

#88

Post by meibo »

bratao wrote: post #7

Please Cloudflare, I'm a paying customer and have some IPv6 only users that are very frustrated every time they see a Cloudflare challenge page. Your provider, HCaptcha still do not support IPv6. I have to use workarounds like an alternative domain without CF and this is very frustrating.

HCaptcha is the absolute worst, their captchas are consistently harder, the datasets are impossible to decipher and the failure rate is much higher, even if I'm sure that I chose the right options. My parents had no chance last time they ran into one.

CF should have just rolled their own captcha service instead of buying into someone else's public ML training program again.

Re: A public letter to CloudFlare to fix their snoopy vendor

#89

Post by captn3m0 »

btown wrote: post #81
r1ch wrote: post #11

Glad to see this getting attention. Flexible SSL is an awful option that has no place in the modern encrypted web. Out of the four SSL options Cloudflare gives users, only one is actually secure. It's a huge foot-gun.

On the contrary, the idea that a mom-and-pop shop running an HTTP website on some ancient shared hosting can easily just drop in Cloudflare is a Good Thing. Sure, you're not removing the attack surface, a state actor could intercept the server-to-server connections... but at least the hacked router in your customers' coffee shop is removed from the threat model. You make it any tougher, and that HTTP website is just…

Hence, my recommendation of a "Big Red Warning" on picking anything lower than Strict SSL.

A user must knowingly choose this option, and many websites which picked Flexible SSL could easily be upgraded to Strict SSL today. CloudFlare must work towards upgrading these users, especially where it can easily identify that SSL is supported at the origin server (such as Shopify, GitHub etc).

Re: A public letter to CloudFlare to fix their snoopy vendor

#90

Post by ec109685 »

Sohcahtoa82 wrote: post #77
ec109685 wrote: post #73

Earlier quoted context omitted.

That doesn't make sense. If I hit amazon.com on my browser, which is IPv4 only, t-mobile needs to provide a (private) IPv4 IP to the phone to make that possible. Edit: was totally wrong about this: https://www.internetsociety.org/resources/deploy360/2014/cas... iOS (since IOS 12) and Android have native clients that can tunnel IPv4 requests over an IPv6 only network that are used for providers like T-Mobile.

Not necessarily. T-Mobile could respond to DNS requests with an IPv6 address that includes an encoding of Amazon.com's IPv4 address in it so that when you try to connect it it, the gateway knows what IP address you're looking for and can do the NATing there. Of course, this is just conjecture about a possible way of making it work, and it could easily get broken if you configure your phone to use a different DNS serv…

Thanks, that's a good point. Apple talks about it here: https://developer.apple.com/library/archive/documentation/Ne...
Post reply on HN