> authorities [...] would force them to install [...] flow logging

This doesn't necessarily require Cloudflare's cooperation. Remember when the NSA tapped Google's internal network without their knowledge? SSL added and removed here :-)

Not really internal. Long distance fiber lines between sites, mostly leased.

They were DC<->DC fiber links, carrying unencrypted Stubby RPC traffic. Internal is an accurate descriptor.

Suffice to say internal to Google's network architecture at the time, subsequently remediated with encryption, but physically external to Google DCs.

It did raise a fascinating question about where the physical tap was and how the take was routed back.

You do the tap at a hub, and you have the egress connectivity, but you're one unexpected employee away from discovery.

You do the tap in the middle of nowhere, and how do you get the data stream back?

I'd guess they went rural and just leased physically adjacent dark fiber to route out on.

The return routes are most likely in the same run but just a different strand. I think this is the way underwater cables are tapped - no need for a completely new run back.

Level 3 basically admitted they did it for them, so it would have been at a hub.

That Google incident sounds interesting, do you have links to the technical explanations? From a quick search all I could find are news reports.

It's from the OG PRISM slides. Previously Google's internal production network didn't use encryption, SSL/TLS was terminated at the perimeter. So the NSA simply tapped their dark fiber between data centers.

But it becomes significantly easier if Cloudflare performs this cooperation; most ISPs are required to maintain such data as well.

Except, Cloudflare already proxies 10% or more of all HTTP traffic (has plaintext access to most of it). If the authorities wanted to DPI away, there's already more to look at even without these VPN offerings.

> From a purely technical perspective this seems to be a slightly worse version of Apple Private Relay.

Private Relay is a well thought out design. Microsoft Edge Secure Network is merely a proxy because it is built for a different threat model: https://archive.is/pNnW5

DPI at ISPs or Cloudflare isn't really what I'm concerned about; it's the impending destruction of the VPN service model by mandating censorship and logging.

I'll be curious to see what tactics they (the political block in the West that's acting in quasi concert to enhance domestic espionage capabilities) attempt to use to accomplish it in the US given the enshrined protections we have that Europeans typically lack, which in theory should make it very difficult to censor VPNs here. The logging requirement aspect may end up being the part they can more readily get through in the US (one that will survive freedom of speech etc challenges).

VPNs aren't the solution to surveillance and censorship. Tor-style networks are better suited. Some of which are already in the process of standardization by the IETF.

> DPI at ISPs or Cloudflare isn't really what I'm concerned about

Well, that was like 50% content of the comment I replied to.

The usability of Tor is very PGP like. Personally I never seen one or introduced to one vibrant / healthy society. Also it's trend since a long time ago, people don't really mention about Tor sites on the clear net. (Ye, I know about the hiddenwiki)

Seems to me NSA likely already have internal access at CF as they do at Apple, looking at what Snowden released + time passed, so it is a likely next step.

>However, in this case, and because of the ClientHello permutation in Chromium based browsers[1] such as Edge, Cloudflare gets a high-entropy identifier + IP address, which, along with SNI header inspection, could be theoretically used to identify individual users.

As per your own source, a different permutation is used per connection, so it's unclear how it would help to "identify individual users".

I stand corrected wrt the operators; while the diagram mentions that there is an ingress and egress component, it is not clear as to whether two different entities operate them. I've updated my comments to reflect that.

Iff they're the same operator, I assume there'd be a TLS connection between Microsoft Edge Secure and the Edge browser, and that'd be a long-lived session because of the nature of proxying traffic, which means there's a static identifier. Even if it wasn't, IP addresses may themselves be considered as sensitive enough for such identification.

> I really hate to be that guy, but I'm afraid that Cloudflare partnering with every browser to offer a VPN is just going to draw the attention of authorities

On the bright side, maybe they'll protect it with their "One more step...please wait while we verify your browser" system, which has such a high false positive rate (in my experience) that few people could actually access it.

That only blocks people with secure, locked-down browsers, so it won't be a problem for Edge users.

>There is already precedent for this happening in Russia; in that incident every VPN pulled out of the country. However if everyone enforces it, it's gonna be hard.

Not only that, ISPs now close all connections which look like VPN traffic. I used to have my own OpenVPN server as a window to the free world and now it doesn't work... I wish there was some kind of open standard which doesn't leave a very obvious signature which is easy to detect by ISPs. I don't know if HTTP CONNECT can be hidden from ISPs? I guess I'm going to try Edge after all.

You could look into Shadowsocks, V2Ray and similar.

It's also been a while I've read about these topics, so I'm not sure if Russia also does entropy analysis and fingerprinting differences to block these protocols either.

You may like reading about the new TSPU system in Russia [1], and discussing your issues on [2].

[1] https://censoredplanet.org/tspu

[2] http://ntc.party

The Chinese have been fighting this war for a while. The results are in favor of users: see Trojan-gfw, Xray-core, v2ray

Try switching to 443/tcp or try a high port like 10000/udp. The first might look rather like streaming over https and the second like an encrypted RTP stream in a mad SIP n RTP session.

You can also co-exist OpenVPN on 443/tcp with a "real" web server. The usual use case for that is getting more value out of a single IP address. Put your pony fan club website up or an Ubuntu default webpage.

Another possibility is to use port knocking to open ports before the OVPN connects.

... and now I come to think of it:

PPTP is generally believed to be broken so it might be "allowed" because it will be assumed that grabbing and storing the stream will be sufficient for later analysis. Then you put a OpenVPN inside the PPTP tunnel with proper, modern encryption.

... 53/tcp or udp might be worth trying too. 123/udp - ntp, 25/tcp - email! Basically try being weird - it may well work!

What is Russia going to do? Block 30% of the web and 90% of the most important sites?

Maybe eventually?

https://www.scientificamerican.com/article/russia-is-trying-...

China does.

China isn't blocking cloudflare, cloudflare has a separate network for China

https://www.cloudflare.com/application-services/products/chi...

China is blocking the RoW Cloudflare since websites and web hosting services need to be officially certified by the government by way of an ICP recordal.

Many CDNs set up a China specific network which customers can use it subject to presenting their recordal; that’s what Cloudflare China is.

So...

Not blocking cloudflare China?

You should do some research on Matthew Prince, his background is very interesting. He's pretty much the only tech CEO who I could say "yeah, I trust him".

I'm not saying your concern isn't valid, it's a great point. Only that if anyone was going to run a company like Cloudflare, we're lucky it's Matthew, he's not a dumbass.

He runs the largest man-in-the-middle service online. I wouldn't put an ounce of trust into him

I read his wiki. Didn’t see anything of the hates three letter agencies or the American government variety. I did see this:

> In 2008, the Department of Homeland Security (DHS) contacted Unspam Technologies, asking, "Do you have any idea how valuable the data you have is?" The DHS' email served as the impetus for Cloudflare, a technology company Prince co-founded with Holloway and fellow Harvard Business School graduate Michelle Zatlyn the following year.

Which sounds like the opposite of what we would want. Cloudflare being started because a three letter agency told him that harvesting internet data is valuable. Unless his take away was “they do that too? Better try to stop it!”

Is there something else you’re referring to?

> Only that if anyone was going to run a company like Cloudflare, we're lucky it's Matthew, he's not a dumbass.

This may be totally true, but it's extremely important to understand that it does not matter.

As a US-based company Cloudflare is subject to NSLs (https://en.wikipedia.org/wiki/National_security_letter) which will force them to reveal all traffic and never talk about it. There's nothing they can do to resist that, regardless of founder personality.

Combine this with the fact that Cloudflare terminates TLS traffic, so it's all in the clear within their infrastructure. It would be difficult to think of a more juicy target for intelligence agencies waving NSLs.

It'll all be classified so we'll never know (unless some future Snowden tell us). But it is logical and wise to assume all traffic passing through Cloudflare is siphoned off in cleartext to the TLAs.