this post was submitted on 08 Jun 2024
244 points (89.1% liked)

Privacy

32109 readers
788 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
244
The Cloudflare Poison (sh.itjust.works)
submitted 5 months ago* (last edited 5 months ago) by Scolding0513@sh.itjust.works to c/privacy@lemmy.ml
 

Daily reminder that sites "protected" by cloudflare are effectively MITM attacks. HTTPS is now even more worthless. Cloudflare can see everything. this is a known fact and not a theory.

And if you think Cloudflare aren't being tapped by the NSA, you're sadly sadly naive.

All the "privacy respecting" sites use it too. So remember, as soon as you see that cloudflare portal page, you can assume that everything you plug into the site is property of NSA Inc. Trust no one, and do not trust code being served to you over the web if it comes through CF, there is no way to know what they've modified.

Edit: good info link below https://serverfault.com/questions/662946/does-cloudflare-know-the-decrypted-content-when-using-a-https-connection

you are viewing a single comment's thread
view the rest of the comments
[–] jjlinux@lemmy.ml 9 points 5 months ago (2 children)

I'm basically running all my self-hosted services over CF tunnels. Does anyone have a suggestion for an alternative to this? I'd like to remove CF from my life, but not at the expense of poking port holes in my FW.

[–] Harrison@infosec.pub 11 points 5 months ago (1 children)

Yes there are a bunch of self-hosted options like frp, all of which require an endpoint on the internet somewhere, typically a cheap or even free VM. Here's a pretty comprehensive list:

https://github.com/anderspitman/awesome-tunneling

[–] jjlinux@lemmy.ml 3 points 5 months ago (1 children)

Thanks so much. Now I have another way to avoid my family this weekend 🤣🤣

[–] Harrison@infosec.pub 9 points 5 months ago* (last edited 5 months ago) (1 children)

Remember not to compromise security in favor of privacy. To me they're both important, but security wins every time.

Remember that services directly accessible over tunnels, whether from cloudflare or frp or ngrok or whatever, are directly accessible over the internet. So if any of those various self-hosted services have a remote vulnerability, and EVERYTHING does sooner or later, you will be exposed. This is why I personally WG VPN to my home LAN rather than exposing most of my stuff via any sort of tunnel. Tailscale is another option I often recommend.

I do use CF tunnels for specific purposes; Home Assistant Google Home integration for example, but I secure that via their "zero trust" authentication by validating incoming IP ranges, so only Google can reach the tunnel in the first place, everybody else is stopped by Cloudflare. For other services with human users, I have them authenticate via github or google oauth first. I also run all services accessible by the internet by any means on a restricted VLAN firewalled off from the rest of my LAN.

[–] jjlinux@lemmy.ml 2 points 5 months ago

Agreed. I have a lot of homework to do before I even know which way to leap to.

[–] possiblylinux127@lemmy.zip 1 points 5 months ago

Wireguard and a cheap VPS