Hacker News Reader

Comment by eis | Hacker News Reader

The article mentions that WARP is exposing the end user's IP to websites they visit. I'd be interested in how they do that, especially with HTTPS websites where they can't MITM and inject headers.

> WARP is not designed to allow you to access geo-restricted content when you’re traveling. It will not hide your IP address from the websites you visit.

View on HN

Great eye! We haven't figured out how to expose them yet for sites not using Cloudflare. We do have some experience solving this problem for Spectrum [1] we're hoping to lean on. The most important thing to us is users don't expect us to keep their IP private, as that is not the intent of WARP.

1- https://blog.cloudflare.com/mmproxy-creative-way-of-preservi...

Are you going out of your way to forward the original IP to the end recipient? What's the point of that?

Is it to support IP authenticated logins or similar?

Most likely so the receivers of abusive traffic can contact the original ISP rather than Cloudflare having to deal with abuse reports.

analytics.

For instance, to play nicely with IP whitelisting in firewalls as an additional security measure.

Not step on the toes of Netflix, Amazon Prime and other services that rely on geo location for enforcing licensing of content / geo-location based artificial scarcity of digital goods?

I'd like an answer to this also!

It sounds like cloudflare spent the time to do away with hiding ip addresses. Actively removing that feature of a VPN, which you should get for free in a wireguard implementation, seems fishy to say the least. Especially since no reasonable explanation for this was given.

From the deafening silence I'm going to take the less charitable interpretation that it's meant to enable Cloudflare to essentially sell Warp users' IPs to Cloudflare customers as an added perk.

That is a bit worrying.

Although Warp doesn't mask IP addresses, it should be useful for these two use cases:

1) Communicating with insecure websites (HTTP instead of HTTPS)

2) Using unsecured wireless networks (e.g. Wi-Fi at a coffee shop)

Beyond these two cases, is there any advantage to using Warp? Does Warp provide any benefits for email (secure IMAP/SMTP), file sharing (BitTorrent), or other protocols?

It looks decent for hiding your traffic from your ISP

Thanks, this should have been obvious in hindsight.

One more for people with cell phone plans that don't adhere to net neutrality: Warp can probably bypass quality caps on video streaming.

Traditional VPNs are strictly better than Warp+, as far as I can see, but the free version of Warp is a generous offering for users who would otherwise not be using a VPN.

Warp excludes many sites from traffic routing (like video)

Are you sure? Some comments like this one say that Warp affects YouTube speed:

https://news.ycombinator.com/item?id=21070988

Source? That seems like a huge caveat - WARP protects your privacy except for specific sites you visit that Cloudflare silently decides on?

> WARP is not designed to allow you to access geo-restricted content when you’re traveling. It will not hide your IP address from the websites you visit.

I think that's because Warp doesn't let you select the location of the server you're connecting to. Almost all VPN services have servers in different areas, and you can choose which geographic area you want an IP address from. In contrast, Warp only lets you connect to a server that's close to you.

Based on speed tests, it doesn't look like Warp is bypassed for video content.

That’s not the same thing - they could provide your IP to the site you visit in an added header or something without compromising your privacy from your ISP. That doesn’t imply they aren’t routing traffic to some websites.

Found it.

> Warp and Warp+ will not route traffic data from your device through the Cloudflare network for certain Internet properties, such as over-the-top content provider websites, as determined by Cloudflare in its sole discretion.

https://www.cloudflare.com/application/terms

"Over-the top content provider websites" most likely include Netflix, Hulu, Prime Video, etc.

https://en.wikipedia.org/wiki/Over-the-top_media_services

If this is the case, then Warp would not be helpful for evading speed caps for video on mobile data plans.

What's the actual vulnerability when simply using an unsecured wireless network? Sure, it's easy for them to MitM you if you're using http, but if you're only using https, what's the harm?

DNS queries and the unencrypted parts of the HTTPS protocol (like SNI without recent enhancements). So passive sniffers can at least see what sites you're visiting.

Huh, didn't know about SNI, thanks for the info. Seems like a relatively small risk though.

You forgot your ISP, some collect and resell your activity online

Some yes. In Australia, all are required by law to record "metadata" and retain for several years (5 I think)

WARP+ apparently takes advantage of CloudFlare's Argo Smart Routing https://www.cloudflare.com/products/argo-smart-routing/

Statistics from one of my websites running Argo show a 16.73% percent improvement for 32.3% of web traffic routed through Argo.

For my Google Cloud Washington based server, I see 5-15% improvement for some traffic from the EU and US East Coast and 15-30% improvement some traffic from Asia, Africa, and South America. (all according to CF statistics)

> Statistics from one of my websites running Argo show a 16.73% percent improvement for 32.3% of web traffic routed through Argo.

I don't understand the statistic. Is that the best 32.3%? Is the worst 32.3% 16.73% worse?

Thank you for your reply. I see that it's rather easy to do that for websites running behind CF as you terminate the traffic and can just set the corresponding header.

But for websites outside your network I don't see any obvious way how to do that. Wouldn't this being possible imply that it's possible to spoof traffic? That would open a whole can of worms for the web and even the internet at large.

But I also get your point that you don't want people to see WARP as a regular VPN to protect a users IP address from being exposed to the other side. Since it's not easy for a user to see which sites run behind CF and which ones don't while browsing they must keep this in mind. Or they can just firewall all CF IPs minus the ones used by WARP (assuming none are shared with other CF products and a list can be obtained).

Can you have an option to do that? I imagine in some cases it might be better for people (in certain regions or roles) where their IP being hidden is a core component of "Privacy First".

>The most important thing to us is users don't expect us to keep their IP private

I would dare to say you're wrong. It's one big reason I wouldn't/won't use Warp.

I think that you're in agreement; he seems to have meant that it was important that Cloudflare clarify to users that their IPs will not be masked.

On the app stores it's shown as a privacy tool. Nowhere they make it clear, which is honestly a bit sad.

Warp doesn't provide anonymity, however, for some reason Netflix in my phone can stream US TV shows with Warp on while my non warped devices can not even list the show. Weird.

It seems to not be hiding IP, but it does inadvertently(?) do so for some site's detection methods I think. When I did an IP lookup, some sites reported correct while others reported one I didn't recognize (assumed its the one from WARP).

Ya it only forwards the IP for websites behind CF for now https://news.ycombinator.com/item?id=21070828

Because Netflix is not a Cloudflare client, so CF can't pass the source (client) IP. The same should happen with Google, Facebook (or anyone not behind CF infrastructure).

At least, that's the way I'm currently understanding it.

This split tunneling article may be useful. https://www.macobserver.com/news/tmo-scoop/cloudflare-warp-s...

The requests come from a CloudFlare address range -- my original IP isn't visible to the server. Not sure what they mean either.

It passes on your IP address if the website you're visiting is using CF. See for yourself:

https://icanhazip.com - on CF network https://ifconfig.me - not on CF network

I can confirm.

Last night i was testing it and geo-location was visible...

Reply on news.ycombinator.com