Rendered at 10:02:53 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
ZiiS 3 minutes ago [-]
If I want to preserve the privacy of my users I will avoid using massive behavior capturing networks like Cloudflare. The is no world where giving them the tracking is better then just ensuring I anonymize my logs. If my users don't trust me; and are informed enough to understand what this service dose and doesn't cover they are just going to assume I can fingerprint them in some other way.
nirui 7 minutes ago [-]
> such that only the client and app server can see plaintext, and the relay sees only a jumble of ciphertext. A “gateway” sits between the relay and app server to handle all of this cryptography — decapsulating requests, encapsulating responses — and the app server handles only plain HTTP
Wouldn't that be better if you design an oblivious encryption method so the encryption and decryption is handled by the origin server (a.k.a Target Resource in the RFC) and the Client? Instead of letting anyone in the middle to handle that data?
Their current design looked not that different than if you just connect to a public anonymous SOCKS5 server (which don't decrypt TLS traffic) and uses it to connect to a website hosted behind Cloudflare. It would probably work the same way too, since someone has to host a "OHTTP Relay" the same way they host a anonymous SOCKS5 server.
simondotau 51 minutes ago [-]
I have absolutely no reason to think Cloudflare is a covert CIA operation. In fact, I’m sure there are plenty of good reasons to think it isn’t. But if it were, pretty much everything it does is exactly what you'd expect from one.
Joker_vD 33 minutes ago [-]
Of course it's not a CIA operation — that agency is foreign intelligence agency. The domestic intelligence agency is called NSA.
0x073 6 minutes ago [-]
As cloudflare is the gateway for half the Internet and the other half is meta Google and Microsoft, I would prefer to share my IP with the website I visit instead some big tech companies.
But maybe I get privacy wrong.
Joker_vD 56 minutes ago [-]
Hm. Interesting. I wonder how you would add "banning abusers by IP" functionality to it though — you first need to identify the abuse somehow and then link it to the originating IP (or any other kind of identifier)...
dokyun 3 hours ago [-]
SSL added and removed here :-)
cpa 1 hours ago [-]
To those missing it, it’s a reference to an internal NSA presentation that shown this sentence with an arrow at the boundary of google network and the internet.
You can google the sentence directly to find it.
3 hours ago [-]
arshxyz 2 hours ago [-]
> a typical client-server exchange creates a trail of user data, like the client’s IP address or TLS fingerprint. This level of visibility can be a burden.
Does Cloudflare's WAF (which relies on TLS Fingerprinting) stop working if OHTTP is enabled? If not, does this imply the client metadata is read and processed by Cloudflare but not passed on to the application server?
indeyets 3 hours ago [-]
Has strong TOR (Onion Routing) feeling
42droids 6 hours ago [-]
Next step: ClInternet: the World Wide Web by Cloudflare. :)
chairmansteve 5 hours ago [-]
"Jesters do oft prove prophets".
- King Lear
dzink 6 hours ago [-]
The irony is that the majority of people that need this don’t have the cognitive time or skill to process and set it up for themselves. But the agents and bad actors like North Korean hackers would absolutely have the time and ability to implement and use it. Then you have the market for lemons problem - if requests coming from here are malicious most requests coming from here will be seen as malicious. Aka dark alleys earn their reputation over time.
adlotsof 5 hours ago [-]
Not sure how north korean hackers benefit from not knowing who is accessing their servers?
roozbeh18 4 hours ago [-]
We have Cloudflare Tunnels to thank for this. I wish Cloudflare did more to stop malicious use of Cloudflare Tunnels.
est 3 hours ago [-]
I thought ohttp is opt-in. You have to participate their beta to enable the relay/gateway.
Same applies to Apple's Private Cloud Compute. A service provider has to join the program to avoid reading visitor's source IP.
It will handicap service provider's capability if I am not mistaken.
therein 5 hours ago [-]
I think you misunderstand. This is for inbound traffic, not outbound.
ranger_danger 5 hours ago [-]
Does any current proxy/tunnel/VPN software support OHTTP as a transport method?
What about browsers making general website requests to services that support it?
jon-wood 2 hours ago [-]
iCloud Private Relay (available on every macOS and iOS device in recent years) uses OHTTP to obscure your identity from sites you visit.
Naru41 5 hours ago [-]
Pathetically, people probably won't even erase cookie, let alone JavaScript. To begin with, any websites are not designed to be viewable without js. There are countless ways to find fingerprints. It is impossible to prevent tracking anyway in current the internet.
jon-wood 2 hours ago [-]
It’s entirely possible if the application developers have made the choice to intentionally avoid tracking and tying personal data to user identity, which is exactly who this product is aimed at.
Wouldn't that be better if you design an oblivious encryption method so the encryption and decryption is handled by the origin server (a.k.a Target Resource in the RFC) and the Client? Instead of letting anyone in the middle to handle that data?
Their current design looked not that different than if you just connect to a public anonymous SOCKS5 server (which don't decrypt TLS traffic) and uses it to connect to a website hosted behind Cloudflare. It would probably work the same way too, since someone has to host a "OHTTP Relay" the same way they host a anonymous SOCKS5 server.
But maybe I get privacy wrong.
You can google the sentence directly to find it.
Does Cloudflare's WAF (which relies on TLS Fingerprinting) stop working if OHTTP is enabled? If not, does this imply the client metadata is read and processed by Cloudflare but not passed on to the application server?
- King Lear
Same applies to Apple's Private Cloud Compute. A service provider has to join the program to avoid reading visitor's source IP.
It will handicap service provider's capability if I am not mistaken.
What about browsers making general website requests to services that support it?