I imagine that instead of beating TLS, state actors work with Cloudflare and the other CDNs who terminate the connection to listen in.
from lntl@lemmy.ml to privacy@lemmy.ml on 08 Oct 19:47
https://lemmy.ml/post/53747605
from lntl@lemmy.ml to privacy@lemmy.ml on 08 Oct 19:47
https://lemmy.ml/post/53747605
I was orginally going to post to c/showerthoughts… but then I thought it might fit in better here.
threaded - newest
The CDN’s are the MitM.
What exactly are the CDNs?
The Man in the Middle (MitM).
I.e. if they’re terminating TLS and then forwarding to your TLS servers then they are capable of inspecting all the traffic to and from your service.
This is exactly what a MitM attack in is.
This sounds like it defeats the purpose of a private DNS. At least there is VPN.
A VPN isn’t going to protect you from CloudFlare being compromised and you’ll never even know.
Likewise a private DNS will still be resolving to the CF addresses.
Yes this is absolutely a risk…
You are entirely correct. What Cloudflare does is also valuable and tricky to replicate though, so people reeeally want to deny it
Everyone has different values
Let’s be clear that not just any state actor can do this. We’re talking about the US, UK, rest of the eyes alliance. Snowden revealed they are the threat who operates like this and we shouldn’t forget it.
India can’t likely do this, China, Russia, Brazil, South Africa cannot do it.
<img alt="" src="https://lemmy.ml/pictrs/image/16512952-7a7b-433f-b9e7-77c6b8144426.jpeg">
I missed why China, Russia, et al cannot do it. What do you mean?
why wouldn’t that be the purpose of cloudflare? the system is designed to do what it eventually does. Not what we are told, hope, or dream.
cloudflare in its service, provides a clean, efficient way, to centralize, a decentralized independent internet. Giving whoever holds the keys to cloudflare control over those resources, for whatever purpose. Ban’s ? Instant. Shadow ban, easy. Hoax (redirecting traffic) simple. The idea that ‘but they’re not supposed to’ is childish.
Never give people power over you. Ever.
Or certificate providers are ordered to provide a false certificate; or in case of Europe (thanks to the GDPR), the “data protection officer” that larger services operating in the Union (including cloud- and hosting-services: hosting most of the modern internet), are forced to employ and provide with unrestricted access (supposedly “to monitor compliance”), may be ordered to do additional processing (including that for which their “employer” has no legal basis), whilst being gagged by “professional secrecy” (including towards this “employer”); and the NSA also has a program that seeks to weaken TLS standards (at least by pushing standards for post-quantum encryption (PQE) only, instead of AES + PQE).
Tailored Access Operations (TAO) would be the NSA team in charge of it.
Been saying this for years. Check my comment history.
Cloudflare also forces you to enable javascript, so allowing them to fingerprint and de-anonymize you
i was aware of this, but didn’t think much of it because everyone’s doing this, but i switched to jshelter a week ago and 👏 every 👏 single 👏 site 👏 forces me to disable it to use it besides – even the catgirl protecting lemmy.