Hacker News Reader

Comment by crazygringo | Hacker News Reader

> the VPN will automatically connect when you’re using public Wi-Fi or browsing unsecured networks and sites lacking a valid HTTP certificate.

OK, that's actually a pretty decent idea. It's not going to be always-on, but it's providing security specifically for things like coffeeshops/libraries and for sites that don't provide their own security. In other words, it's "backup security", not rerouting all of your "normal" secure traffic at work/home.

This mainly protects sites you visit from having JavaScript injected into them by networks when there aren't any other protections, and the VPN is run by Cloudflare so it will be performant, so I don't really see any problems here? Seems like a positive development actually.

View on HN

Just curious but is there really a risk on public WiFi if you’re using DNS-over-HTTPS and connecting to a site over https?

No, though DNS-over-HTTPS is already basically a proxy.

No it isn’t. The DoH server is the final destination. It isn’t relaying your traffic to somewhere else.

By this definition, any DNS server is basically a proxy (assuming you are not hitting an authoritative name server for the domain you are trying to access).

You can still do reverse domain lookups using the IP address as well as see the domain in the SNI details.

So the content is safe but the sites you visit are still exposed unlike with a vpn.

Although you would commonly find a long list of AWS or similar IP addresses which wouldn't be very useful, unless you simultaneously crawl tens of thousands of possible sites (from the same source IP range) to map IPs to sites.

> This mainly protects sites you visit from having JavaScript injected into them by networks when there aren't any other protections, and the VPN is run by Cloudflare so it will be performant, so I don't really see any problems here? Seems like a positive development actually.

How does this protect from having JavaScript injected? Why couldn't the VPN do that?

MITM protection on public networks maybe?

> MITM protection on public networks maybe?

How does this address the fact that the operators of the VPN can certainly modify any content they access over http on your behalf?

Better than every public wifi access point being able to.

The operators of the VPN in this case are also the developers of the browser. If they want to inject content they can do that without the VPN.

It's a question of how many entities you have to trust. There are many thousands of public networks around the world and millions of people using ISPs which tamper with traffic (especially on mobile networks). With the VPN, you only have to trust the VPN provider; without it, you have to review each network you use and its ISP. That doesn't mean that the VPN is automatically trustworthy, of course, but it's a single entity.

Note that you still have to trust the server's ISP and any intermediate ISP routing traffic from the VPN exit node to the server, if you're accessing a server over an insecure protocol.

Of course, but almost all of the tampering has happened on the client end historically, especially since this VPN is backed by Cloudflare who have widely distributed nodes. It’s still much better to deploy TLS everywhere but this shuts down most of the non-NSA attacks.

Absolutely, I just wanted to give the full picture.

It's reducing the number of parties you have to trust from 'every hop along the path from the public wifi operator to the host' to 'cloudflare', and many site operators already trust cloudflare not to MITM them.

I don't think that CF already MITMs most of the internet is such a great argument for letting them MITM the rest.

It's security by consolidation.

Security by consolidation to single point of failure, I might add.

I agree, and it's hard for me to trust the VPN more than my own ISP. Like yeah, someone else on this public coffee shop wifi network can waste a whole day finding a couple of random victims. Does that actually happen, idk. Have huge, reputable VPNs been hacked before, yes, and there's much greater incentive there. Either way I won't know, so it feels like they're selling snake oil.

"Microsoft" and "security" also don't go together in my head.

coffee shop hacking is usually done in an automated, at-scale fashion, often with a remote device that doesn't require an operator to be present or paying attention.

It uses lowest common denominator tactics. This VPN strategy is precisely for the lowest common denominator.

I don't understand how something can feel like snake oil when you haven't researched your own questions. I can sow doubt on anything; is it always justified?

The question is whether your basket is made of chains (one bad link), cables (many bundled wires), how many baskets there are, how many eggs in each, and how effective and trustworthy the guards are.

Simply shrieking "SPOF!!! SPOF!!!" lacks naunce after a while.

I've concerns with proposals such as this similar to what others are voicing on this thread. But if one considers the proposal in light of the present status quo for the typical person, then it's probably a net improvement.

The assumption is that the VPN operator is more trustworthy than an unsecured network.

Yeah, and even if the network operator is trustworthy, often times any other user on that network can mess with you, e.g. ARP poisoning.

How hard it would be silently push an update to redirect all google traffic through VPN. We have already seen them trying to get google search query and results. And why stop at Google basically they can do any website they want.

They’re not magic. They can’t peek into the TLS connection between your browser and google.com.

Conversely many people here think TLS is magic and unhackable, but it is not.

I’m not sure what you mean. Do you know how to break TLS?

Yes a MITM attack. Exactly what cloudflare does to provide their services over TLS.

But that’s not a problem with TLS any more than you giving out your AES keys is a problem with AES.

I’m not sure even how to respond to this. If a protocol is weak due to a flaw, like being susceptible to MITM attacks, then yes it is a problem with the protocol.

This is exactly my point. People are desperate for there to be no flaws in TLS, so much so they ignore MITM attacks.

The only way they can do that is at the client level, not the network level. Whether it's running over a VPN or not, your traffic to Google is TLS, so you have an excellent guarantee that it's impossible to snoop on the contents of your HTTP requests at the network level.

However, you are using a Microsoft client and/or a Microsoft OS to do this - and of course, if they want to, Edge or even Windows itself can report on the input and output of any operation you make, regardless of any network security. Similarly, WhatsApp or Signal or iMessage or Android/iOS could send a copy of the plain text of any messages you send or receive to home base despite them being E2E encrypted on the wire. You always have to trust the device and client software you are using to access the internet.

So, if you personally don't trust Microsoft not to snoop on your traffic with Google, using Edge or Windows is completely wrong.

> your traffic to Google is TLS, so you have an excellent guarantee that it's impossible to snoop on the contents of your HTTP requests at the network level.

It’s definitely not impossible, MITM attacks work for TLS and this is exactly how cloudflare work (it MITMs TLS sites by terminating the tunnel and recreating.). TLS is only secure if you have pinned certs.

MITM for TLS only works if you have the cooperation of the server owner (like Cloudflare does, or illegally be stealing the server owner private keys) or a malicious CA, or if you ignore the security errors that the browser offers.

Otherwise, TLS is completely impervious to MITM attacks as a protocol.

Of course, various implementations of TLS may also have exploitable vulnerabilities.

I’m not sure what you refuted here, you seem to have said exactly the same thing I did.

Reply on news.ycombinator.com