Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Cloudflare silently injects its analytics when you switch nameservers

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 217 posts

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#61

Post by threecheese »

kazinator wrote: post #47
bawolff wrote: post #31

Earlier quoted context omitted.

The most likely answer is the person accidentally enabled the cloudflare reverse proxy without understanding what they were doing. It seems incredibly unlikely cloudflare does this when just DNS hosting, if for no other reason then that this would break so many things.

If this is HTTPS, how would Cloudfare have the certificate for your domain so that browsers don't warn about a mismatch? Or is it that when you sign over DNS to a provider, they can take over your cert? They can "ass-cert" their own? :)

As far as I know they terminate all TLS; it’s one of the tradeoffs using them.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#62

Post by bawolff »

MrJohz wrote: post #54
bawolff wrote: post #31

Earlier quoted context omitted.

The most likely answer is the person accidentally enabled the cloudflare reverse proxy without understanding what they were doing. It seems incredibly unlikely cloudflare does this when just DNS hosting, if for no other reason then that this would break so many things.

When you set up CNAME and certain other records in Cloudflare DNS, it defaults to (and heavily discourages you to disable) "proxied" records, which I believe means that the record points to a Cloudflare-owned host which then acts as a reverse proxy to whatever value you'd set. So from the console it looks like you've set the CNAME to a certain value, but in practice it'll be set to a different thing and transparently…

On the other hand. Proxying websites (for ddos protection, cdn, etc) is their primary product. Its what they are known for.

I think a better question is: why would you be using cloudflare, if you didn't want that?

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#63

Post by bawolff »

kazinator wrote: post #47
bawolff wrote: post #31

Earlier quoted context omitted.

The most likely answer is the person accidentally enabled the cloudflare reverse proxy without understanding what they were doing. It seems incredibly unlikely cloudflare does this when just DNS hosting, if for no other reason then that this would break so many things.

If this is HTTPS, how would Cloudfare have the certificate for your domain so that browsers don't warn about a mismatch? Or is it that when you sign over DNS to a provider, they can take over your cert? They can "ass-cert" their own? :)

Yes, the person who controls the DNS controls the certificate.

What a certificate is supposed to verify is that traffic is going to the right place. If you designate cloudflare as the rightful host of your website then they can get a certificate.

This isn't an edge case though. This is cloudflare's primary product. It is why users use them.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#64

Post by muvlon »

threecheese wrote: post #61
kazinator wrote: post #47

Earlier quoted context omitted.

If this is HTTPS, how would Cloudfare have the certificate for your domain so that browsers don't warn about a mismatch? Or is it that when you sign over DNS to a provider, they can take over your cert? They can "ass-cert" their own? :)

As far as I know they terminate all TLS; it’s one of the tradeoffs using them.

They have a product called Magic Transit that offers DDoS protection and such for plain IP traffic, where Cloudflare does not terminate TLS. Pricing is not public but starts in the five-digit USD per month range according to people I talk to.

This may tell you something about how keen Cloudflare are to handle traffic they themselves cannot decrypt.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#66

Post by nilram »

stagas wrote: post #25
celsoazevedo wrote: post #4

Yes, they add the js if "web analytics" is enabled. I believe I had to manually enable it on my old sites though. Maybe it's enabled by default when adding new domains?

No, I hadn’t enabled for any site. I had to enable first to turn it off.

Maybe send it to them as a bug. Seems more like a mistake than malevolence.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#67

Post by 1vuio0pswjnm7 »

okzgn wrote: post #37

An alternative: https://only-scripts-allowed-from-here.com "> This makes the client only load self-hosted scripts, or scripts only from the specified origins, among the other directives CSP allows (e.g. restricting styles, images, frames, etc.): https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP

If Cloudflare (CF) has r/w access to the response body, which CF does have by default, then CF can easily modify or remove that tag. The risk is not abated

The risk of third parties injecting scripts, etc., e.g., analytics, advertising, etc., into response bodies (web pages) is usually cited as a rationale for using HTTPS^1

CF somehow avoids the usual objections. CF is a MiTM but few people object

1. For example, a data collection, surveillance and advertising services company that operates a www search engine and releases a web browser may not want an ISP to inject scripts, etc., e.g., analytics, ads, etc., into web pages as it might compete with the company's business. As a defense against such ISPs and other third parties that are potential competitors for data collection/surveillance/advertising services, it might favor HTTPS sites in its www search engine results, promote HTTPS at conferences discussing its web browser, etc.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#68

Post by Terr_ »

userbinator wrote: post #51

This reminds me of the old free hosts that would inject their own scripts/ads on pages hosted by them, but their implementation would do it only after detecting the closing HTML tag (either or , can't remember) and the various tricks to get around it, including omitting the tag (browsers don't care), rAnDoM case tags (some were hardcoding lower or upper and comparing case-sensitively), and messing with the content ty…

I'm getting flashbacks to Proxomitron, a localhost proxy in the HTTP days when it was also much harder/impossible to make browser plugins.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#69

Post by Aeolun »

bawolff wrote: post #31
Animats wrote: post #27

> injected a JS analytics snippet in my HTML-only JS-free site textlog.cc Cloudflare injected hostile code into a site they are not even hosting? If it's HTTPS, how do they even do that? Does it violate the "exceeds authorized access" provision in the Computer Fraud and Abuse Act?

The most likely answer is the person accidentally enabled the cloudflare reverse proxy without understanding what they were doing. It seems incredibly unlikely cloudflare does this when just DNS hosting, if for no other reason then that this would break so many things.

> It seems incredibly unlikely cloudflare does this when just DNS hosting

Not to mention impossible when ‘just’ DNS hosting. Though I suppose they could secretly replace the stated IP with one of their own anyway and then still proxy the content.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#70

Post by okzgn »

1vuio0pswjnm7 wrote: post #67
okzgn wrote: post #37

An alternative: https://only-scripts-allowed-from-here.com "> This makes the client only load self-hosted scripts, or scripts only from the specified origins, among the other directives CSP allows (e.g. restricting styles, images, frames, etc.): https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP

If Cloudflare (CF) has r/w access to the response body, which CF does have by default, then CF can easily modify or remove that tag. The risk is not abated The risk of third parties injecting scripts, etc., e.g., analytics, advertising, etc., into response bodies (web pages) is usually cited as a rationale for using HTTPS^1 CF somehow avoids the usual objections. CF is a MiTM but few people object 1. For example, a d…

Thanks for the background context, very interesting and realistic. Yes, of course it also has read/write access, though I always make sure there’s no interference of that kind. It has only happened to me once, where a binary I hosted on Pages didn't work when downloaded with wget (though that happened several years ago).
Post reply on HN