Why Cloudflare Is a Threat to the Internet Privacy

56 points

2 years ago

1. Cloudflare handles approximately 20% of all the traffic on the internet. And it's growing fast. In 2017, it was 10%. [1], [2]

2. It's impossible to use Cloudflare proxy without giving up encryption of data. They are a man-in-the-middle that has access to unencrypted information of all the traffic they proxy. (Yes, even with Full-Strict/Keyless SSL)

3. Of the remaining 80% of internet traffic, 43% comes from Netflix, Google, Amazon, Facebook, Microsoft, and Apple, none of which seems to be using Cloudflare, which makes Cloudflare the ultimate tool to break encryption on distributed servers. Only 37% of the internet traffic is routed outside these major tech companies. [3]

4. In July 2021, a random guy discovered a vulnerability on Cloudflare's cdnjs that allowed a complete takeover of the CDN, which is estimated to be used by 12.7% of websites. The NSA has a whole division dedicated to discovering and exploiting zero-day vulnerabilities on systems. Even if Cloudflare is not willingly feeding unencrypted traffic to the NSA, it is a single point of surveillance that, if compromised, breaks the whole encryption of a good portion of the internet. [4], [5]

5. Cloudflare follows a freemium pricing plan. In 2016, Cloudflare's CEO Matthew Prince said in an interview that only 4% to 5% of the websites they protect are paying customers. The cost of maintaining Cloudflare infrastructure for the remaining 95% of customers that use it for free is unclear, as Cloudflare does not run ads on the sites it protects. [6]

6. In the same interview, he mentions that the initial impetus for Cloudflare came after an acquisition by the Department of Homeland Security of his previous project, Project Honeypot, in 2008, which demonstrates that the government was at least aware of it since the beginning. [6]

---

*Bibliography:*

[1] https://twitter.com/AxelrodG/status/1447938954758705155

[2] https://www.cloudflare.com/press-releases/2017/cloudflare-introduces-argo-a-virtual-backbone-for-a-faster-more-reliable-internet/#:~:text=Cloudflare%20handles%20more%20than%2010%20percent%20of%20all%20HTTP/HTTPS%20Internet%20traffic%2C

[3] https://www.sandvine.com/blog/netflix-vs.-google-vs.-amazon-vs.-facebook-vs.-microsoft-vs.-apple-traffic-share-of-internet-brands-global-internet-phenomena-spotlight

[4] https://blog.ryotak.me/post/cdnjs-remote-code-execution-en/

[5] https://en.wikipedia.org/wiki/Tailored_Access_Operations

[6] https://www.bbc.com/news/business-37348016