Stop the proposal on mass surveillance of the EU

Re:Stop the proposal on mass surveillance of the EU by danuker on Thursday February 02, 2023 @01:44PM (#34631227)

Or Cloudflare which is a MitMaaS

[ Parent | on HN ]

Re:Stop the proposal on mass surveillance of the EU by intelVISA on Thursday February 02, 2023 @02:18PM (#34631693)

I love this term and hate that it's true.

[ Parent | on HN ]

Re:Stop the proposal on mass surveillance of the EU by Lucasoato on Thursday February 02, 2023 @06:31PM (#34634863)

Sorry, can I ask you what MitMaas stands for?

[ Parent | on HN ]

Re:Stop the proposal on mass surveillance of the EU by woodruffw on Thursday February 02, 2023 @06:36PM (#34634906)

I’m guessing they mean “man in the middle as a service,” referring to the fact that Cloudflare (by design) is a trusted party in your TLS traffic if you use them.

[ Parent | on HN ]

Re:Stop the proposal on mass surveillance of the EU by 1vuio0pswjnm7 on Thursday February 02, 2023 @09:12PM (#34636299)

Similarly, open resolvers, e.g., "public DNS service" from Google, Cloudflare, Cisco (OpenDNS), Quad9, etc. or DNS provided by an ISP. A remote DNS cache is, IMO, a "MiTM". It can censor among other things. Quad9, for example, is doing this right now.

Even so-called "encrypted DNS" such as DNSCrypt or more recently DoH only applies to the path between the client and the cache, not the cache and the authoritative server. In the same way that the path between a client and Cloudflare and the path between Cloudflare and the origin server are separated by CF as a "MiTM".

NB. It's possible to exclude the remote DNS cache and have encrypted DNS between client and authoritative server, the software exists, even for DNSCrypt, but it never caught on. I have often thought about starting a registry that requires registrants to offer encrypted authoritative DNS.

[ Parent | on HN ]