this post was submitted on 07 Nov 2024
251 points (98.1% liked)
Technology
59347 readers
5099 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
It bugs me when people say Cloudflare is a MitM, because that is a disingenuous representation the situation. Mainly that a MitM is done without either party's knowledge or consent. It even describes that in the very first sentence of the wiki page you linked. A better description would be a "middleman", but that's not scary so people don't call it that. It's just a proxy and you opt into it.
If you are signing up for Cloudflare to use their proxy services then you are opting into having a middleman, which then means it cannot be a MitM because both sides of the connection are aware of this layer. They are not trying to hide the fact there is a Cloudflare connection layer to either side. If Cloudflare is a MitM then any networking layer for any hosting service would be considered a MitM as well.
The arguments that Cloudflare is ripe for abuse and the scale of their systems are separate arguments that should also be applied to many other providers but that is never mentioned when people bring this up. It just seems like the MitM claim is just a tactic to leverage fear in an attempt to add weight to arguments that should be perfectly valid on their own.
No, it is a clear description of what is happening: Instead of https keeping the traffic encrypted from user to service, it runs only from user to Cloudflare (and then in some cases from Cloudflare to service, although that's irrelevant here). The result is that a third party (Cloudflare) is able to read and/or modify the traffic between the two endpoints. This is exactly what we in mean in cryptography discussions by man-in-the-middle.
You can decide that you don't mind it because it's not a secret, or because they haven't been caught abusing it yet, but to say it's not a man-in-the-middle is utter nonsense.
No, the service operator opts in to it, without consulting the user, and usually without informing them. The user has no choice in the matter, and typically no knowledge of it when they send and receive potentially sensitive information. They only way they find out that Cloudflare is involved is if Cloudflare happens to generate an error page, or if they are technically inclined enough to manually resolve the domain name of the service and look up the owner of the net block. The vast majority of users don't even know how to do this, of course, and so are completely unaware.
All the while, the user's browser shows "https" and a lock icon, assuring the user that their communication is protected.
And even if they were aware, most users would still have no idea what Cloudflare's position as a middleman means with respect to their privacy, especially with how many widely used services operate with it.
To be clear, this lack of disclosure is not what makes it a man in the middle. It is an additional problem.
This is false. Being aware of a man in the middle and/or willingly accepting it does not mean it ceases to exist. It just means it's not a man-in-the-middle attack.
The point is that Cloudflare is a provider that you can choose to have as a part of your own infrastructure.
It is NOT a man in the middle as man in the middle implies "attack"
If Cloudflare is a man in the middle, i can make similar evil claims about anyone using Google Drive or Microsoft crapware. Loads of governments store sensitive documents on Microsoft services and Microsoft actually actively breaks contracts by messing with said data.
At least, as far as we know, Cloudflare has no I'll will.
Yet
Indeed.
That can be a convenient shorthand if the parties in a discussion agree to use it as such in context. For example, in a taxonomy of cryptographic attacks, it would make sense. It is not the general meaning, though, at least not a universally accepted one. Similarly, "counter" does not imply "counter attack", unless we happen to be discussing attack strategy.
More to the point, nothing that I wrote misrepresents the situation as was claimed by that other person. If I had meant attack, I would have said attack. Rather, they made a leap of logic because I (like most of my colleagues) don't happen to follow a convention that they like, and picked a fight over it. No thanks.
Since you're going to childishly talk about me and infer something that is entirely false, I'm going to step in here.
First, you claim it's "a convenient shorthand", except "middleman" is far shorter than "man-in-the-middle". So that argument is entirely false.
Next, "nothing that I wrote misrepresents the situation"? You literally linked the Wikipedia article for "Man in the middle attack", but conveniently left out the word "attack" both when referring to it and in the link itself which redirected to the actual Wiki page https://en.wikipedia.org/wiki/Man-in-the-middle_attack.
You are clearly intentionally misrepresenting the subject in order to frame things to suit your narrative. That's not just a claim out of nowhere, I provided evidence to support this.
And get out of here with your pathetic "like most of my colleagues" pretentious attitude.