Troy is clearly very pro Cloudflare and Azure. I’m only familiar with them at a high level and it would be great to hear counterpoints to his praise and get (at least the impression of) a debate that encompasses their pros and cons.

+1 for being interested in expanding this

Basically they add yet another layer of centralization and they're a MITM for all your traffic, so they're an easy target for surveillance. If only they weren't so convenient... I use their DNS service because it's top notch, but I also tend to enable their MITM service because their CDN nodes are super fast and require just a single toggle to enable. They read my far-future expires headers and just cache the content on the edge, no extra work needed.

Doesn't know about Cloudflare but as a Microsoft Regional Director he's certainly pro Azure.

Such a weird title; it makes me think he works for them, but he doesn't

didn't he work for microsoft previously?

No, he worked for Pfizer - https://www.troyhunt.com/today-marks-two-important-milestone...

He says that he supports CF because they enable SSL on so many websites that wouldn't have it otherwise. I guess the fact that he gets a lot of their premium features for free helps as well.

The fact that CloudFlare has "Flexible SSL" leads me to believe they don't care about security at all. I've asked them to at least post a "CF-SSL: Flexible" header or similar to responses so someone could develop a Chrome extension to alert on this behavior.

They're presenting sites over HTTPS to visitors while tunneling the full request in plain text over HTTP across the internet back to the origin server. Because of this, web browsers like Chrome will allow access to sensitive APIs like Geolocation despite the end to end communication being insecure.

If I could, I'd personally blacklist all "Flexible SSL" sites from my daily browsing.

Just revoke CF's certificate on your local machine. If they won't tell you when they're being flexible you have to assume they're always being flexible.

That has undesired effects. I have a page that uses SSL CF<->server via their certificate. The certificate for the end user is still a CF certificate. The end user has no way of finding out if the connection to origin is encrypted.

Agreed. It's getting a bit much, almost every one of his blog posts has some advertisement for Cloudflare.

2 of Cloudflare's 3 SSL options generate an insecure setup yet look perfectly fine to the user with a shiny green padlock in the address bar. That really isn't acceptable.

In this case though, security concerns do not apply; the source data is secure, the website does not use authentication, and HTTPS adds an extra layer of security on any input (which is hashed and cropped clientside)

> on any input (which is hashed and cropped clientside)

You could still run a volume analysis on the reply. If it's very short, you can guess it's a 404. If it isn't, you might be able to get which prefix was queried... \end{tin foil hat}

That won't work since all possible 5 character prefixes return data.

They don't all return the same amount though. According to my Chrome here and now:

> https://api.pwnedpasswords.com/range/aaaaa = 28.8KB

> https://api.pwnedpasswords.com/range/01234 = 28.5KB

> https://api.pwnedpasswords.com/range/af0fa = 23.2KB

Isn't Chrome seeing the decrypted and decompressed response in DevTools? I'd be more interested in what you see in Wireshark.

Sadly not available on my current machine :(

The experiment is left as an exercise to the reader :)

Can you elaborate on that?

OP is probably referring to [1] or the general fact that they MITM most traffic that uses their services.

[1] https://blog.cloudflare.com/incident-report-on-memory-leak-c...

Tbf that's the actual service they offer. It's not like they are being sneaky.

To be sure, but anybody using CloudFlare needs to keep in the back of their head that everything going through CF is not only accessible to a hypothetical Bad Guy at CloudFlare it can also (and remember has, this is a real bug that happened) get exposed to unrelated parties on the Internet if CF mixes your data with somebody else's by mistake.

This makes CF seem fine for your different variants of popcorn.gif, your (subresource integrity checked) Javascript implementation of the VIC-20 computer, or a public blog post, and NOT so great for patient access to histology results, private web forums, banking, and many other things on the Web.

Of course they do that. How else would such a service possibly operate?

By offering two different models and letting you choose between them for each hostname under Cloudflare.

1) Injecting themselves on the application layer (the current model)

2) Injecting themselves on the network layer, passing through only encrypted traffic between the client and your servers

Not every feature they currently offer would still be possible in model #2, but most of them (including DDOS protection) can still work in a limited fashion.

Coming soon

That's very good news! The knowledge that a large part of my internet usage is MITM'ed by a single entity is continuously making me uncomfortable.