Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Cloudflare silently injects its analytics when you switch nameservers

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 217 posts

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#71

Post by bawolff »

muvlon wrote: post #64
threecheese wrote: post #61

Earlier quoted context omitted.

As far as I know they terminate all TLS; it’s one of the tradeoffs using them.

They have a product called Magic Transit that offers DDoS protection and such for plain IP traffic, where Cloudflare does not terminate TLS. Pricing is not public but starts in the five-digit USD per month range according to people I talk to. This may tell you something about how keen Cloudflare are to handle traffic they themselves cannot decrypt.

Magic Transit uses BGP magic to work. That only makes sense at scale - i believe you have to have your own ASN for it to work.

Realistically its a totally different product, and 5 digit price is probably cheap relative to competitors in that space.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#72

Post by ____tom____ »

hackernud3s wrote: post #57
kazinator wrote: post #45

If you're only using Cloudfare for DNS, but HTTPS connections go directly to your server, how does it inject HTML? You must be allowing Cloudfare to terminate your HTTPS connections; i.e. using them for actual proxying.

The orange cloud icon in dns settings, in other words, but that's opt-out too. So yeah - double opt-out I guess.

I have no idea what 'the orange cloud icon' means, as I'm not a CloudFlare used.

But DNS/Name servers do not see HTML traffic, as the above poster mentioned, so it's not obvious how this change would matter.

Is it that they are serving their HTML via CloudFlare, and cloudflare is making changing in its serving of their html?

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#74

Post by stackghost »

purpleidea wrote: post #5

Yikes! I see this too: https://static.cloudflareinsights.com/beacon.min.js/v4513226... " integrity="sha512-ZE9pZaUXND66v380QUtch/5sE9tPFh2zg45pR2PB0CVkCtOREv2AJKkSidISWkysEuQ0EH8faUU5du78bx87UQ==" data-cf-beacon='{"version":"2024.11.0","token":"c0859b51a7804ab5a9cc8e9e2b2c4cde","r":1}' crossorigin="anonymous">

I'm not seeing this on my site (if you want to check: https://stackgho.st), are you using their `strict` http settings? I.e. is your server terminating TLS or is theirs?

edit: perhaps it's only for sites added after that policy came into effect

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#75

Post by pcmaffey »

okzgn wrote: post #37

An alternative: https://only-scripts-allowed-from-here.com "> This makes the client only load self-hosted scripts, or scripts only from the specified origins, among the other directives CSP allows (e.g. restricting styles, images, frames, etc.): https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP

Also can add "Cache-Control: no-transform" header, which prevents modifying the payload.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#76

Post by zx8080 »

kevincox wrote: post #32
purpleidea wrote: post #5

Yikes! I see this too: https://static.cloudflareinsights.com/beacon.min.js/v4513226... " integrity="sha512-ZE9pZaUXND66v380QUtch/5sE9tPFh2zg45pR2PB0CVkCtOREv2AJKkSidISWkysEuQ0EH8faUU5du78bx87UQ==" data-cf-beacon='{"version":"2024.11.0","token":"c0859b51a7804ab5a9cc8e9e2b2c4cde","r":1}' crossorigin="anonymous">

Yup, I explicitly had all anaytics turned off. But had a few sites using Cloudflare for caching. Now I'm checking and seeing this on all of them. This is gross and unacceptable. "Caching" does not mean "modifying my site".

MITM attack, that's what it is. Why is this not in the news? Ah, no one cares.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#77

Post by supermdguy »

____tom____ wrote: post #72
hackernud3s wrote: post #57

Earlier quoted context omitted.

The orange cloud icon in dns settings, in other words, but that's opt-out too. So yeah - double opt-out I guess.

I have no idea what 'the orange cloud icon' means, as I'm not a CloudFlare used. But DNS/Name servers do not see HTML traffic, as the above poster mentioned, so it's not obvious how this change would matter. Is it that they are serving their HTML via CloudFlare, and cloudflare is making changing in its serving of their html?

Cloudflare sets up a reverse proxy as part of their core offering, so by default they can MITM your proxy. The “orange cloud” by a DNS record means it points to their proxy instead of your server.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#78

Post by 1vuio0pswjnm7 »

1vuio0pswjnm7 wrote: post #67
okzgn wrote: post #37

An alternative: https://only-scripts-allowed-from-here.com "> This makes the client only load self-hosted scripts, or scripts only from the specified origins, among the other directives CSP allows (e.g. restricting styles, images, frames, etc.): https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP

If Cloudflare (CF) has r/w access to the response body, which CF does have by default, then CF can easily modify or remove that tag. The risk is not abated The risk of third parties injecting scripts, etc., e.g., analytics, advertising, etc., into response bodies (web pages) is usually cited as a rationale for using HTTPS^1 CF somehow avoids the usual objections. CF is a MiTM but few people object 1. For example, a d…

FWIW, I operate own DNS (including own custom root.zone) and I MiTM own TLS traffic with a localhost forward proxy. With this setup I get r/w access to response bodies, I add a CSP as an HTTP response header, and a long list of other traffic manipulation. There is no tracking, ads, telemetry, etc. Nothing leaves the computer unless I allow it. Operating DNS plus forward proxy gives me lots of control

Letting Cloudflare (CF) operate DNS and direct traffic through its proxies gives CF control

It's interesting to see how they use it under market pressures

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#79

Post by reaperducer »

zx8080 wrote: post #76
kevincox wrote: post #32

Earlier quoted context omitted.

Yup, I explicitly had all anaytics turned off. But had a few sites using Cloudflare for caching. Now I'm checking and seeing this on all of them. This is gross and unacceptable. "Caching" does not mean "modifying my site".

MITM attack, that's what it is. Why is this not in the news? Ah, no one cares.

Why is this not in the news?

Good point. There should be a place where hackers can get this kind of news. Some kind of Hacker News place.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#80

Post by hahn-kev »

pcmaffey wrote: post #75
okzgn wrote: post #37

An alternative: https://only-scripts-allowed-from-here.com "> This makes the client only load self-hosted scripts, or scripts only from the specified origins, among the other directives CSP allows (e.g. restricting styles, images, frames, etc.): https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP

Also can add "Cache-Control: no-transform" header, which prevents modifying the payload.

Does it prevent it? Or just request it? There's no way to enforce that is there?
Post reply on HN