Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
There are discussion about Cloudflare.
https://bugzilla.mozilla.org/show_bug.cgi?id=1426618 https://trac.torproject.org/projects/tor/ticket/24351
They keep repeating "Cloudflare is not a MITM attack". How do you counter this argument in technical way?
Unfortunately, you cannot counter it without being technically incorrect.
Per Wikipedia, the definition of a Man in the Middle attack:
"In cryptography and computer security, a man-in-the-middle attack (MITM) is an attack where the attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other."
The website owners who configure their site to use Cloudflare do not believe they are communicating directly with the visitors, so under the technical definition it's not a MitM attack.
Cloudflare is contracted and paid by the site owner to perform the service that Cloudflare is doing. Therefore, by definition, Cloudflare is part of the site owner's network of service providers, and as long as Cloudflare is providing services as specified in the contract, it is not an attacker and the provided service is not an attack.
Saying that Cloudflare is a MitM is analogous to saying that eBay/Amazon are MitM between you and sellers. Asking browsers to block Cloudflare is akin to asking browsers to block eBay/Amazon because you don't like those marketplace's terms and conditions.
What CDN providers like Cloudflare is doing is actually a lot better than the situation before Cloudflare and CDN providers like it came along. Before CDN become commonplace, many ISPs implements a caching proxy between you and the content provider (this is actually still common in countries with less developed internet infrastructure). In many cases, the ISP would modify the page the users are viewing, usually injecting their own ads into the page and possibly scanning the site to figure out what ads to serve. The terms and conditions for this "service" is usually effectively hidden from the user and it's almost never brought to the user's attention when the user signed up for their Internet service. Most users would never notice that their ISP are doing this and there's usually no way for users to control which sites or part of the page should be cached and which should be served direct.
When CDN came along, the tables are turned. Instead of working for the user's ISP, now the caching proxy is working for the content provider. The content provider explicitly opt in to use Cloudflare rather than being forced into it by their Internet provider. And since the content providers know their content best, they have control over which part of their site can use shared cache, and which part of the page should use direct connection. The only effective drawback is that with CDN, the Terms and Conditions for the caching service is now accepted by the content provider, rather than the user.
Security conscious content providers that wants to use a CDN usually would have two servers, one serving bulk and public content through the CDN, and a secure static server that serves security sensitive data. If your content provider are not doing such separation and are serving sensitive serving personal information using a service provider that's not fit for the purpose, then you should blame your content provider, not the service provider, because it's the content provider's responsibility to secure your personal data and it's the content provider's choice to use Cloudflare.
If major browser starts blocking major CDN providers by default, many site owners will likely remove HTTPS to allow their content to be cached by ISPs. We're not going to go back to a world with ubiquitous HTTPS and without CDN.
(In what follows I refer to the transport-layer security protocol formerly known as SSL as "TLS", because all versions of the original SSL are no longer secure and should not be used.)
The issue is whoever filed the Bugzilla report has an agenda in mind: anything less than an end-to-end unbroken chain of TLS goodness is a MITM attack and therefore to be feared. Mozilla has pointed out in their response to this report that Cloudflare is a CDN (Content Delivery Network) which means they have to do what they are doing with TLS in order to do what their customer is paying them for.
Troy Hunt (the author and maintainer of "Have I Been Pwned?") explains in the following blog post that the alternative to Cloudflare in many cases is to operate with no transport-layer encryption at all (because the service provider at the origin can't handle it): https://www.troyhunt.com/cloudflare-ssl-and-unhealthy-security-absolutism/
That page also explains how, TLS or no TLS, nation-state-level actors can always access your stuff. You should not be using CloudFlare for anything which is so sensitive that interception of the data is hazardous to your health.
HTTPS provides end-to-end encryption of your traffic between your browser and the server holding the private key corresponding to the TLS certificate.
When you go to a HTTPS website on cloudflare's CDN, cloudflare holds the private key for the certificate presented to your browser (and it's pretty obvious that it's cloudflare; e.g., the certificate's common name is usually something like sni241623.cloudflaressl.com with a dozen or so Subject Alternative Names for the sites it serves). Or you could run a whois on the IP address corresponding to the domain name you are visiting; you'll find it's owned by cloudflare.
Note for a site to use cloudflare, the owner has to point their DNS records to cloudflare's servers, at which point they effectively handed cloudflare full control of their website (as long as the DNS records point to cloudflare's servers). They can prove control of a domain to certificate authorities who will issue certificates for your domain to cloudflare.
Now cloudflare has control to eavesdrop and log any user interactions with your website or silently tamper content if they please.
However, this is not a Man-in-the-Middle attack, because the website owner gave cloudflare permission to do all of this. So it's not an attack, it's a secure connection to cloudflare (who the website owner gave permission to serve content at their domain name).
It's no different than a company outsourcing their website to a third party that designs and hosts the website. There's a third party that could do nefarious things, but was given full permission by the appropriate owner.
Or it's like how many websites run on shared hosts or purchase virtual private servers, where administrators at the hosting company can get at all the data on your server if they wanted. If some admin at your VPS host with root access to the servers really wanted the private keys to your running webserver, they can get them. (Note things like full disk encryption inside your VM can be sidestepped, because they control the host's hardware and can read your VM's memory.) But again, people that use shared hosts/VPS chose to trust the companies to be reputable.
In the end, that's all you have. You have to trust that the organization running the website at the other end is trustworthy with whatever data you give them by browsing there. When visiting websites on the cloudflare CDN part of the trust is in cloudflare.
(This is in contrast to real MitM attacks, where some attacking middleman who does not have authorized access eavesdrops and/or tampers with the network traffic).
