I don't understand why Cloudflare is used by so many sites. I would guess that for 95% of it's users, it doesn't solve any real problem.
http://www.slashgeek.net/2016/06/07/cloudflare-making-intern...
http://www.slashgeek.net/2016/06/07/cloudflare-making-intern...
Is there a more comprehensive free tier anywhere else ?
P.S. I'm not saying they are the best choice. They are simply too convenient & comprehensive to get started. With a single click your site can "claim" to be HTTPS even though the upstream connection "may not" be encrypted.
It's probably better if you define the comparison in terms of flexibility/control etc etc, but simply stating it's 'better' doesn't really add anything to the conversation.
(It's still not really "DDoS protection", by the way. They just don't offer that on their free plan.)
In the end, if there were true competitors, it probably wouldn't matter much, they would be just one popular service that handed your data like many others
CloudFlare being a CDN has very little lock-in and is incredibly easy to move away from, so it speaks to how much value they deliver with their product that they have so many customers.
A typical hosting provider would shut down the port if they see any heavy ingress traffic. Or maybe won't shut it down if their network can tolerate it, but won't bother to filter either, so the server would be overwhelmed and down anyway. There are providers that help, but they cost extra.
CloudFlare, on the other hand, is $20/mo (or even free). Not much protection at this level, but it well-scares kiddies away with "uh, it's behind the CloudFlare", and if someone still hates you (and you haven't screwed up concealing where the real server is), you can upgrade the plan and still try to remain online.
Don't see any other value, except, maybe, for caching/CDN stuff. TLS is done wrong (as described in the OP article), DNS management is a toy (the old fart in me always prefers the zonefiles), minification should be done (and we do) at packaging phase - not runtime and WAF doesn't have any details about what it does (half of the rules are, basically, "enable the we-dont-tell-you-what-it-does rule and hope it won't break your site in a subtle manner").
It takes 10 seconds to sign up, is cheap, makes something complicated very simple, and offers immediate value. Anyone building a developer tool should use CloudFlare as a case study.
EDIT: To the person who replied to me: Heroku, Shopify, and other similar services already serve their sites as HTTPS; Cloudflare just lets you throw HTTPS on a custom domain. It's HTTPS from top to bottom, don't worry.
your_server <--- no TLS ---> CloudFlare <--- TLS ---> Browser
That's not an acceptable setup. If I am communicating to a service that is TLS protected and I see the little green icon in the top left of the bar, I should be confident that my data that I am communicating to you is not routed over the public internet unprotected!
You say this:
> makes something complicated very simple
You made it simple by simply not doing it
Traditionally certificates have been very expensive for little unpaid blogs to have, and difficult to setup. LetsEncrypt is a very new solution but it will be a long time until hosts support it; remembering most of us are on simple cPanel setups so until it's baked INTO cPanel and hosts have upgraded it's unusable for a majority of the web. Just because we can run a web site doesn't mean we can hack layers into web internals.
This is in part the fault of LE's idiotically short and crippling certificate lifespan. Lord knows why they did it but they knew it would screw us from the beginning. "Hey you should automate this, but seeing as you can't, no cert for you."
Google prefers https content. Cloudflare gives small people a better slice of those readers.
Ultimately nobody gives a shit that you're reading the semi-encrypted content I publish. NOBODY. Oh no you read how a database works? If that's illegal where you live then I think you're in much deeper survival problems than whether your browser button is magically misleading you (which it isn't; it's a guide, one that reveals itself once you click through, which is again exactly how it was designed).
Say I want to serve a static HTML website from a Google cloud storage over SSL. No way to do this for free with let's encrypt. 1 click and free with cloud flare.
Is there MITM chance between cloud flare and Google? Yes. For a static website with no login or input from users, seems safer than any free alternative I know of.
https://cloud.google.com/storage/docs/hosting-static-website
Gives you a site at your name.com
Only missing link is the HTTPS which you get with cloud flare
Cloudflare essentially gives you free SAN certs at the edge nodes, which is something you typically have to pay for (to the tune of $$$$s) with other CDNs. Most CDNs give you the more typical SNI certs.
Also, as an aside, isn't it more likely for an end-user to get MtM'd than for that to happen to data centers?
CloudFlare's free plan uses SNI.
Relatedly, Tor recommends all users use HTTPS[3], as otherwise the connection from the exit node to the target site is vulnerable to MITM. Given that there are malicious exit nodes[4], seems like a good idea. But, as the article brings to light, that still doesn't make any guarantees of safety.
[1] https://en.wikipedia.org/wiki/Room_641A [2] e.g. http://www.infoworld.com/article/2925839/net-neutrality/code... [3] https://www.torproject.org/docs/faq.html.en#CanExitNodesEave... [4] e.g. http://www.cs.kau.se/philwint/spoiled_onions/ but plenty of other sources
Many online providers don't care if the NSA is slurping up their data. For example, do you think that Macy's online is going to stick out their necks to protect clothing transactions from the government?
Nope.
Personally, I've seen end-users more worried about MtM close to their endpoint, such as their employers or schools scanning their traffic. They're not trying to evade governments here.
If you see that little green icon, you can be confident that the server you're communicating with has done the bare minimum to satisfy the browser gods today, so that the https everywhere people will stop yelling. It's never meant anything else. It's best to assume you're talking to a TLS terminator which communicates to the HTTP endpoint via AMPRnet (unencrypted IP via amateur radio).
How much of a risk is this in practice, assuming that when I do illegal things I'm very careful to only use sites that I know are end-to-end encrypted, and so for sites going through CloudFlare I'm only worried about criminals snooping for identity theft or credit card theft or similar purposes? [1]
I'd guess that criminals are overwhelmingly more likely to manage to intercept things near the browser side of things than near the server side of things. Probably most likely would be by taking over a public facing wifi router. I'd expect that getting in between CloudFlare and the server would take resources beyond most non-government actors.
[1] Note: I am NOT making an "if you aren't doing anything illegal, you don't need to worry about government snooping" argument. However, there is plenty of information that I consider confidential in the sense that I do not want it generally known, but where the government already knows that information. So, if some site asked me for such information and I needed to decide if they are providing adequate security I would only need to consider non-government snoopers because government snoopers already have the information.
My impression is that this will rule out most coffee shop owners from tampering with the connection through their router. Even if state actors can still get at your content, this is still better than "no SSL whatsoever".
Honestly, though, for anything beyond "static HTML on some server somewhere", basic SSL conf. is a 30 minute one-time job...
This breaks the expectation that if a website is using HTTPS the connection is encrypted from source to destination. I'm not sure it's better as it's effectively giving the user a false sense of security.
FWIW a lot of infrastructure terminate TLS at the load balancer as well. HTTPS does not mean e2e encryption. HTTPS means you're securely talking to their infrastructure.
your_server <--- no TLS ---> CloudFlare <--- TLS ---> Browser
"You don't use CloudFlare? Are you enterprise?"
Amazon is also adept at this. Many of their database and storage services are great but EC2 is overpriced and they overcharge for bandwidth. I see loads of people who only use them for compute and who would be much better served by Digital Ocean or Vultr. But you're not a serious deployment if you don't over-provision on Amazon... and then put the whole thing behind CloudFlare.
Go to a dev or IT conference and you can see this marketing in full force. The style of it reminds me a lot of performance automotive marketing that you would see around a Nascar event.
The periodic pre-load "checking your browser" delay, and the absolutely infuriating, and almost constant, captcha makes it a positively user hostile service.
I won't use the net from public wifi without VPN active, which now means cloudflare asks for that captcha for every site in its control, and re-asks every 30 minutes. A year ago it was rare for the captcha to pop up, now it's near permanent.
Most of the time now I'll just go elsewhere.
They won't automatically unproxy you without notice. If you're getting attacked, you need to pay for the level of protection you need.
Author here. They've done precisely that to me in the past. I don't have first-hand experience with their current policies (if they have changed at all), but still hear similar stories with some regularity.
I'd like to know if people are still getting that email.
The only ways I can think of finding the origin involve user error:
1. DNS history lookup where they're still using the same IP address.
2. Scanning the internet where they aren't ignoring non-Cloudflare
requests.
Enough reasons for me.
I wouldn't necessarily hold it against somebody to have picked CloudFlare because of this in the past, but in 2016 it's simply no longer a reason to keep using CF.
Enough reason not to.
https://scotthelme.co.uk/tls-conundrum-and-leaving-cloudflar... https://stirling.co/blog/cloudflare-mitm/
Please stop repeating the same exact thing instead of actually understanding what you're talking about, it's just misinformation and FUD at this point. You still havent replied to any of the other questions.