News for hackers. Stuff that matters.

A comment on RFC 9849. TLS Encrypted Client Hello. Parent comment

Re:RFC 9849. TLS Encrypted Client Hello by gzread on Wednesday March 04, 2026 @06:53AM (#47246187)
Why would Clownflare ever see traffic to sites not on Clownflare?
[ Parent | on HN ]
Re:RFC 9849. TLS Encrypted Client Hello by szmarczak on Wednesday March 04, 2026 @06:56AM (#47246216)
They do routing. Even if you're connecting to a non Cloudflare server, the traffic may still be routed through their servers.

Why would they want to peek traffic? Most likely for statistics (most frequently visited websites etc).

[ Parent | on HN ]
Re:RFC 9849. TLS Encrypted Client Hello by gzread on Wednesday March 04, 2026 @07:24AM (#47246480)
Can you give an example of a BGP route or traceroute to a site not on Clownflare that was routed through Clownflare?
[ Parent | on HN ]
Re:RFC 9849. TLS Encrypted Client Hello by szmarczak on Wednesday March 04, 2026 @08:33AM (#47247168)
It depends on the origin and the destination. Their Magic Transit service explicitly allow this, and I assume they have agreements with other AS in case something goes wrong on either side (it often does). You'd have to directly ask them to know specifically but I don't think they would answer since that's proprietary information.
[ Parent | on HN ]