this post was submitted on 20 Nov 2023
2 points (100.0% liked)

Self-Hosted Main

515 readers
1 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

For Example

We welcome posts that include suggestions for good self-hosted alternatives to popular online services, how they are better, or how they give back control of your data. Also include hints and tips for less technical readers.

Useful Lists

founded 1 year ago
MODERATORS
communick@selfhosted.forum
2
How are so many sites OK with using cloudflare when they are basically a MITM? (alien.top)
submitted 11 months ago by spottyPotty@alien.top to c/main@selfhosted.forum
87 comments fedilink hide all child comments
 

Regardless of whether or not you provide your own SSL certificates, cloudflare still uses their own between their servers and client browsers. So any SSL encrypted traffic is unencrypted at their end before being re-encrypted with your certificate. How can such an entity be trusted?

you are viewing a single comment's thread
view the rest of the comments
[–] rollinghunger@alien.top 3 points 11 months ago (3 children)

Yes, you’re right that there’s a certain amount of trust you need to have in CF… but what are you trusting it to do? And if they fail, what are the consequences?

Honest question - even if you are sending your Vaultwarden traffic over CF, and they are watching or attacking, you have to trust that the e2e encryption of Vaultwarden is what’s keeping you safe, right? Not the SSL certs. Does the auth mechanism rely on the SSL certs not to be compromised? I would hope not.

For me, it’s about trade offs.

https://www.troyhunt.com/cloudflare-ssl-and-unhealthy-security-absolutism/

https://serverfault.com/questions/662946/does-cloudflare-know-the-decrypted-content-when-using-a-https-connection

These two data sources kinda sum it up for me - “If you are concerned that cloudflare can read your data - don't use cloudflare.”

But I do want to be sure that any e2e encrypted app doesn’t rely on SSL for its “end-to-end”.

[–] Psychological_Try559@alien.top 1 points 11 months ago

Thanks for the link, it's an interesting read with more detail than I've ever heard (not having used cloudflare for this myself).

load more comments (2 replies)