1

I would not like to use CloudFlare since they effectively act as a man in the middle and handle unencrypted data.

Is there a CDN that mitigates the security risks that CloudFlare imposes?

If not, is there at least a DDoS protection service that is considered "secure"?

Improve this question
13
  • 6
    There is no way for an external DDoS protection service to work without having access to your data. If you don't trust CloudFlare, you have to find someone else you trust. There are some providers that provide DDoS protection, but you have to trust them too. You have to trust Digital Ocean right now. If you would state what exactly it is that keeps you from trusting CloudFlare, it would be easier to answer.
    – Josef
    Jul 27, 2016 at 7:28
  • 1
    Hate to nitpick, but DigitalOcean too is man in the middle and handles unencrypted data.
    – techraf
    Jul 27, 2016 at 7:46
  • @Josef this is the article that put me off CloudFlare: cryto.net/~joepie91/blog/2016/07/14/…
    – Jay
    Jul 27, 2016 at 8:32
  • @techraf so are you saying that even if my droplet on Digital Ocean is encrypted with a Let's Encrypt cert, DO can still view all traffic in plaintext? How do they do this??
    – Jay
    Jul 27, 2016 at 8:34
  • 1
    And don't forget that any reassuring advice it guidance you get on StackExchange might come from the NSA.
    – techraf
    Jul 27, 2016 at 9:14

1 Answer 1

Reset to default
4

As @techraf and @josef commented, all DDoS providers have the same challenges:

  • To effectively identify DDoS traffic, a mitigation provider needs to be connected inside your encryption termination point, or at least be a Man In the Middle.

Your concern regarding CloudFlare is the same concern you should have with them all. If you want DDoS mitigation, you need to let the mitigation provider have access. So start considering what the risks actually are from this. And what you need to do in terms of risk mitigation - perhaps contractual terms with the provider?

Improve this answer
5
  • This is completely false; DDoS mitigation providers can block Layer 3/4 attacks just fine without ever seeing the (plaintext) content, and without needing to break encryption. Layer 7 attacks do not need to be handled by a mitigation provider, so that isn't a valid reason either.
    – Sven Slootweg
    Aug 2, 2016 at 19:07
  • Sven - no, only a small subset of DDoS can be handled without inspection. And do you know why? Because it looks exactly like real traffic, in many cases, so it needs to be analysed to distinguish it from real traffic.
    – Rory Alsop ♦
    Aug 2, 2016 at 19:10
  • Yes, and that small subset consists of the Layer 3/4 attacks, which I already pointed out. Which are also the only attacks that a mitigation provider needs to protect against. Mitigation appliances and companies have been doing this successfully for over a decade - hell, providers like OVH do it across their entire network.
    – Sven Slootweg
    Aug 2, 2016 at 19:15
  • Ahh - you misunderstood my meaning. that small subset is grand, but there is a vast amount of DDoS which needs to be analysed so it can be mitigated against.
    – Rory Alsop ♦
    Aug 2, 2016 at 20:55
  • Yes - by analyzing the packet flow, which doesn't require understanding what contents the packets contain. Layer 3/4 attacks are almost always volume-based attacks, which have nothing to do with the actual content of the packets (beyond tracking connections). These are the ones that mitigation providers need to defend against, and volume-based attack patterns are blatantly obvious.
    – Sven Slootweg
    Aug 2, 2016 at 23:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.