Your website just got a boost!
We’ve updated your GoDaddy CDN with new features that make your site faster and safer.
Faster? NO. CloudFlare and all other CDNs can actually make my site SLOWER. I have tested this many times. In various instances, users have reported that the implementation of CDNs led to increased latency rather than improved performance, particularly for specific configurations or traffic types.
Safer? NO. CloudFlare’s code repositories were accessed during a breach, which means hacker(s) potentially have access to critical vulnerabilities and exploits. Additionally, there are concerns regarding outdated code being used by CloudFlare, as highlighted in a blog entry discussing a service delivery failure earlier this year[1].
More Private? NO. CloudFlare is tracking human users and blocking those it can’t track. This can prevent me from accessing my own web site if I protect my privacy on line.
Not only is CloudFlare not safer and faster, it is playing out to be a spy and censorship tool. Here are a few details that everyone should know.
What is CloudFlare?
CloudFlare, to most people, is a box that sometimes pops up when they want to go to a web site. “Verify you are human.” This automated robot box demands you click to prove you are human. Many find this offensive. Each time I check that box I mean it in a “Screw you, unwelcome gate keeper” kind of way. At least send a real human to prove we are not robots. Just kidding. The solution is to hunt down and stop the bots, use tools like honey pots and black holes for bad bots. These tools can find and stop crawlers which do not follow the rules in your web site’s robots.txt file. Put the fools doing that in Internet jail (block their IPs, etc.) and then stop gate keeping the actual humans!
Anyway, Cloudflare is a private company that provides various internet security services, including protection against DDoS attacks (your site gets swarmed by bots), web application firewalls, and SSL/TLS certificate management. A significant part of its service includes the implementation of CAPTCHA systems, which are designed to differentiate between human users and automated bots. God I hate those. Every time I have to click yet again on yet another damn fire hydrant, bus, crosswalk or motorcycle, I mean it in a “Holy friggin’ cripes! Damn you, unwelcome bastard pop-up!” sort of way. These checks often manifest as a pop-up requiring users to confirm they are human, which many find cumbersome or annoying.
ClouldFlare has convinced an untold number of web sites to trust it with protecting them by giving CloudFlare the keys. Brilliant. Why would any tech manager fall for this? Oh, because others already did, so it must be okay. Plus, it saves them time and money. Ca-ching!
CloudFlare is Breaking Encryption
A major issue, however, is that CloudFlare disrupts the intended functionality of SSL by inserting itself between users’ web browsers and servers, transmitting much of the traffic (from itself to the web servers it has taken over) UNENCRYPTED. This represents a significant security flaw, as it allows CloudFlare the potential to intercept sensitive data, including passwords and personal information. Such vulnerabilities could be exploited by attackers if they gain access to CloudFlare’s infrastructure, which has occurred in past incidents[2][3].
Furthermore, gaps in CloudFlare’s security controls have been identified that allow malicious users to bypass protections and target other customers on the platform[1]. This shared infrastructure model raises serious concerns about the overall security of data transmitted through their services.
How Could GoDaddy Allow This?
In my own tests, CDNs (content delivery networks) slow down my web site. I don’t want a CDN, so I followed the directions to turn this off and got the worst surprise yet, the toggle to turn the CDN off has been removed. CloudFlare is now mandatory? Does GoDaddy not know that CloudFlare has been hacked? Does GoDaddy not know that CloudFlare acts as a Man-in-the-Middle attack breaking browser to server SSL encryption? This is one of the final moves for the complete destruction of privacy on the planet earth, as far as the Internet goes. CloudFlare is a private company with no particular authority–as compared to you, me, or GoDaddy–to do what it is doing.
How did CloudFlare Get so Much Power?
Cloudflare has faced speculation and concern regarding its links to the National Security Agency (NSA), particularly in light of its position as a major provider of internet security services. Here are key points regarding this relationship:
– Public Stance on Surveillance: Cloudflare has publicly opposed mass surveillance programs, including those conducted by the NSA. The company has expressed its support for the USA FREEDOM Act, which aims to limit bulk data collection by government agencies, arguing that such practices are illegal and unconstitutional[15]. Cloudflare emphasizes the importance of due process and transparency in any law enforcement requests it receives.
– Participation in PRISM: In response to allegations about the NSA’s PRISM program, Cloudflare has stated that it has never been approached to participate in such programs. The company claims it has never received an order from the Foreign Intelligence Surveillance Act (FISA) court and actively challenges broad requests for data[16]. They maintain a policy of limiting data retention and disclosing any legal requests to affected customers whenever possible.
– Concerns Over Data Handling: Despite Cloudflare’s assurances, some critics remain skeptical about its potential cooperation with U.S. intelligence agencies. Concerns have been raised about the possibility that U.S. companies, including Cloudflare, could be compelled to provide data under U.S. law, including National Security Letters (NSLs) that do not require judicial oversight[17][18]. This skepticism is fueled by the understanding that U.S. companies must comply with local laws, which may include sharing data with government agencies.
– Implications of Being a U.S. Company: As a U.S.-based firm, Cloudflare operates under regulations that could require it to assist in surveillance efforts if requested by the government. This legal framework raises questions about privacy and data security for users relying on its services[17][18].
While Cloudflare publicly distances itself from NSA programs and advocates against mass surveillance, its status as a U.S. company subjects it to potential government scrutiny and legal obligations that could complicate its commitments to user privacy.
Single Company, Single Point of Failure
Hey, let’s run the entire Internet through one company. What could go wrong? Cloudflare operates one of the largest networks on the internet, with data centers in over 330 cities across more than 120 countries. This extensive reach allows Cloudflare to deliver content and services with minimal latency, enhancing the performance of websites and applications for users worldwide. The company processes an average of 60 million HTTP requests per second and 39 million DNS queries per second, showcasing its capacity to handle massive traffic volumes effectively … until it gets hacked or has an outage.
Security Risks: Centralizing services increases the stakes; if Cloudflare were compromised, it could potentially expose vast amounts of data or disrupt numerous services simultaneously.
What “Breaking the Internet” Actually Means
The Internet is intended to be broadly distributed without major points of failure which can be attacked. This is why people say that CloudFlare is breaking the Internet. CloudFlare is breaking the resilience of what is supposed to be a secure and self-healing web of computers and servers which automatically routes traffic around failed nodes. To break this for money, power, convenience or any other reason may be one of the last stupid nearsighted things humans ever do. You don’t realize it, but the now evaporating self-healing decentralized Internet has stood in the way of tyranny and world domination for decades. To rule the world with lies, the Internet, as it was intended to operate, must die. You will probably not lose connectivity to AI bots impersonating humans on social media or to Amazon sized online stores, but your connection to other humans will be progressively filtered and controlled, until it no longer exists. This is the type of breaking that CloudFlare is enabling by owning and centralizing control of Internet traffic. We will get exactly what we are stupid enough not to stop.
Dead Internet Theory
You can see the evidence that Internet destruction is working by checking out the older articles on this web site, look at the comments. Notice that there are comments! I once had 2 million hits in one day on my old web site, mostly actual people, I assume. The comments (look at the dates) on this site are from before Facebook and other Big Social Media had completely eaten the Web. Real people were visiting web sites like this one, leaving real comments. The idea that most actual humans avoid web sites and hide out on social media (where they are guided and censored by algorithms and AI bots posing as humans they’ve never met) is known as the Dead Internet Theory.
Censorship
If you doubt that CloudFlare will censor, please note that it already has done so. It can only do this if server owners allow it to be put in between their servers and Internet users, which they should not do!
- “Cloudflare has already said it will isolate and block Brazilian IP addresses from reaching ExTwitter” [12]
- “Cloudflare’s CEO stated that while they generally resist terminating services based on content, the immediate threat to human life justified their actions in this case.”[13]
- In 2017, Cloudflare terminated its services for The Daily Stormer, a neo-Nazi website, after it published an article mocking the victim of a violent incident. This is a case where CloudFlare, a private company, dictated what is permissible on the internet.[14]
- CloudFlare either now does or will in the future participate with Google in shadow banning web sites, stopping human traffic while allowing bot traffic to avoid arousing suspicion.
The point is they should not be given this power at all. The company should not exist.
Call GoDaddy and Request NO CloudFlare
I have been a loyal GoDaddy customer for decades and this mandatory CDN security hole is unacceptable, so I called GoDaddy. They confirmed that the toggle is missing, that I can’t turn it off myself, that this was rolled out for all users–does that mean just all managed WordPress users?– and they opened a ticket to turn off the CDN for my site and to make this permanent, as they did previously, which was at that time never supposed to be undone!
CloudFlare, a Stealth Surveillance and Censorship Apparatus
Many of tech savvy people have their own web sites like this one because big social media is controlling and censoring content. Installing CloudFlare allows that corporate censorship to extend to individuals with web sites. A creeping crud of communication control is at the door. CloudFlare is grabbing control of your private data as an arm of surveillance capitalism. In practical terms, this means that if you reasonably try to protect your online privacy using a VPN or other means, CloudFlare can block you from your own web site. It can act as a gate keeper to stop all human traffic to any site it “supports” which is a potential disaster for human rights and freedom.
What alternatives to GoDaddy do not and WILL NOT use CloudFlare?
With some research I found that you can get a VPS (Virtual Private Server) with GoDaddy or some other host and run WordPress on that. This option does require some server admin experience. This option will be faster than a shared host, and in some cases, even cheaper than a GoDaddy Managed WordPress instance. So, that’s what I’m considering for this news/art blog if GoDaddy will not turn the CloudFlare CDN off.
Status of Request
GoDaddy has put in a trouble ticket for me to DISABLE the CloudFlare CDN, since they removed the toggle from the web interface. This will be noted in my account as a permanent change. Yeah right. GoDaddy is a great company with so many excellent employees. They have helped me well over the years, but I’ve heard that before about permanent changes to avoid CloudFlare. I’m going to give them 72 hours, and if they can’t deliver the goods, I’m going to consider moving this site to a different host.
Checking if Your Server is Behind CloudFlare
To determine if newsi8.com is using Cloudflare, you can check a few technical indicators:
1. DNS Nameservers: If the domain’s nameservers end with `ns.cloudflare.com`, it indicates that the site is using Cloudflare. Windows:
nslookup -type=ns newsi8.com
MacOS:
dig ns newsi8.com
Result:
newsi8.com. 1444 IN NS pdns1.registrar-servers.com. newsi8.com. 1444 IN NS pdns2.registrar-servers.com.
or you can use
host -t ns newsi8.com
Result:
newsi8.com name server pdns2.registrar-servers.com. newsi8.com name server pdns1.registrar-servers.com.
The nameserver pdns1.registrar-servers.com is not associated with Cloudflare. It is part of the default nameservers provided by various domain registrars, such as Namecheap, for managing DNS records. These nameservers are typically used for domains registered with those registrars and do not indicate any connection to Cloudflare’s services. Cloudflare operates its own nameservers, which typically end with ns.cloudflare.com .
Note that some people have GoDaddy as the domain name registrar. In this case, for Newsi8.com, I do not. Thus, the cloudflare DNS resolution could technically be changed at any time without notice by Namecheap (which I do not think will happen), but also GoDaddy, the WordPress host, could add CloudFlare between the Namecheap DNS and its servers as a CDN. That is the issue here, but others may have the GoDaddy giving CloudFlare DNS control issue(?)
2. IP Address Resolution: You can resolve the domain to see if it returns an IP address associated with Cloudflare.
The IP address 198.71.191.xxx is not associated with Cloudflare. This IP address belongs to GoDaddy, which is known for providing web hosting and domain registration services.
3. HTTP Headers: By inspecting the HTTP response headers, if you see `server: cloudflare` or headers like `Cf-Cache-Status` and `Cf-Ray`, it confirms that the site is behind Cloudflare.
You can use tools like online DNS checkers or browser developer tools (press F12) to inspect these details easily[10].
CloudFlare is Injecting Code into Web Sites
This is sneaky. The Sources in Firefox inspector shows that cdnjs.cloudflare.com IS being used, allowed by GoDaddy. Not only that, they are inserting this Javascript onto my site! Here is a snapshot of the code December 2, 2024.
/*!
* jQuery Mousewheel 3.1.13
*
* Copyright 2015 jQuery Foundation and other contributors
* Released under the MIT license.
* http://jquery.org/license
*/
!function(a){“function”==typeof define&&define.amd?define([“jquery”],a):”object”==typeof exports?module.exports=a:a(jQuery)}(function(a){function b(b){var g=b||window.event,h=i.call(arguments,1),j=0,l=0,m=0,n=0,o=0,p=0;if(b=a.event.fix(g),b.type=”mousewheel”,”detail”in g&&(m=-1*g.detail),”wheelDelta”in g&&(m=g.wheelDelta),”wheelDeltaY”in g&&(m=g.wheelDeltaY),”wheelDeltaX”in g&&(l=-1*g.wheelDeltaX),”axis”in g&&g.axis===g.HORIZONTAL_AXIS&&(l=-1*m,m=0),j=0===m?l:m,”deltaY”in g&&(m=-1*g.deltaY,j=m),”deltaX”in g&&(l=g.deltaX,0===m&&(j=-1*l)),0!==m||0!==l){if(1===g.deltaMode){var q=a.data(this,”mousewheel-line-height”);j*=q,m*=q,l*=q}else if(2===g.deltaMode){var r=a.data(this,”mousewheel-page-height”);j*=r,m*=r,l*=r}if(n=Math.max(Math.abs(m),Math.abs(l)),(!f||f>n)&&(f=n,d(g,n)&&(f/=40)),d(g,n)&&(j/=40,l/=40,m/=40),j=Math[j>=1?”floor”:”ceil”](j/f),l=Math[l>=1?”floor”:”ceil”](l/f),m=Math[m>=1?”floor”:”ceil”](m/f),k.settings.normalizeOffset&&this.getBoundingClientRect){var s=this.getBoundingClientRect();o=b.clientX-s.left,p=b.clientY-s.top}return b.deltaX=l,b.deltaY=m,b.deltaFactor=f,b.offsetX=o,b.offsetY=p,b.deltaMode=0,h.unshift(b,j,l,m),e&&clearTimeout(e),e=setTimeout(c,200),(a.event.dispatch||a.event.handle).apply(this,h)}}function c(){f=null}function d(a,b){return k.settings.adjustOldDeltas&&”mousewheel”===a.type&&b%120===0}var e,f,g=[“wheel”,”mousewheel”,”DOMMouseScroll”,”MozMousePixelScroll”],h=”onwheel”in document||document.documentMode>=9?[“wheel”]:[“mousewheel”,”DomMouseScroll”,”MozMousePixelScroll”],i=Array.prototype.slice;if(a.event.fixHooks)for(var j=g.length;j;)a.event.fixHooks[g[–j]]=a.event.mouseHooks;var k=a.event.special.mousewheel={version:”3.1.12″,setup:function(){if(this.addEventListener)for(var c=h.length;c;)this.addEventListener(h[–c],b,!1);else this.onmousewheel=b;a.data(this,”mousewheel-line-height”,k.getLineHeight(this)),a.data(this,”mousewheel-page-height”,k.getPageHeight(this))},teardown:function(){if(this.removeEventListener)for(var c=h.length;c;)this.removeEventListener(h[–c],b,!1);else this.onmousewheel=null;a.removeData(this,”mousewheel-line-height”),a.removeData(this,”mousewheel-page-height”)},getLineHeight:function(b){var c=a(b),d=c[“offsetParent”in a.fn?”offsetParent”:”parent”]();return d.length||(d=a(“body”)),parseInt(d.css(“fontSize”),10)||parseInt(c.css(“fontSize”),10)||16},getPageHeight:function(b){return a(b).height()},settings:{adjustOldDeltas:!0,normalizeOffset:!0}};a.fn.extend({mousewheel:function(a){return a?this.bind(“mousewheel”,a):this.trigger(“mousewheel”)},unmousewheel:function(a){return this.unbind(“mousewheel”,a)}})});
How to See This Code Using Firefox
Load a web page on Newsi8.com, then press F12 (fn F12 on Mac) and you will see the inspector tools window appear at the bottom of Firefox. Click on the Debugger tab. Under Main Thread, you will see newsi8.com and the things it loads. A separate node from Cloudflare.com contains the AJAX (asyncronous JavaScript, which means it can get loaded whenever Cloudflare wants.) Click that node to expand it and you will find the JavaScript code above.
What does this injected code allow CloudFlare to do?
When Cloudflare injects this JavaScript code into your site, it serves several stated purposes:
Performance Optimization: By using this plugin, Cloudflare may aim to enhance the user experience on your site by providing smoother scrolling behavior, which can be particularly beneficial for sites with extensive content.
Browser Compatibility: The injection helps ensure that users on various browsers have a consistent experience when interacting with mouse wheel events, which can be crucial for usability.
Potential Security Concerns: While the code itself is widely used and generally safe, any third-party script injection raises concerns about security and control over your website’s functionality. It’s essential to ensure that this behavior aligns with your site’s intended functionality.
Unstated Purposes of CloudFlare Injected Code
A Foot In the Door: This code which is allowed by GoDaddy security scanners can be changed at any time allowing CloudFlare to attack users who visit your web site, even on an individual basis depending on their computer and browser’s vulnerabilities. Yes, they can change this code at any time and then change it right back after an attack. This is a hook which allows CloudFlare or it’s puppet master to attack you and your visitors, if they want. Anyone compromising them can do the same. Everyone should be outraged, but no one, apparently not even the technical security gurus at GoDaddy, recognize the obvious threat.
Identify Human Users with Biometric Data: Mouse movements are one way to identify humans. Over time, such movements can be very unique, so they represent digital fingerprints. We spent a lot of time and money making our own web sites to get away from the spying, filtering and censorship which is rampant on big social media platforms and now we get this BS! Grr! To put this is a calm way: this seemingly harmless mouse code is quite insidious. How you move your mouse can tell others many things, sometimes even your mood. Mood data is a big money maker in surveillance capitalism. This injected code now on my web site, newsi8.com without my permission, is covert surveillance of all of my web site visitors. This is like someone installing a movement sensor you can not remove in your house.
Potential for Covert Surveillance: The injection of JavaScript code like the jQuery Mousewheel plugin could facilitate the collection of these mouse movement patterns without explicit user consent or awareness. This raises privacy concerns as it may enable covert tracking of users’ behaviors across different sessions and websites.
Data Transmission: The collected data from these events can be sent back to Cloudflare’s servers through AJAX requests or as part of the HTTP request headers when the user interacts with the page. This transmission can occur in real-time or at specific intervals.
Yes, the injected code can track mouse movements on your website. Cloudflare employs JavaScript to add event listeners to web pages, which monitor user interactions such as mouse movements, clicks, and keyboard inputs. This functionality is part of their bot detection mechanism.
Denials, Lies
You can read that Cloudflare provides infrastructure services like CDN, security, and performance optimization for websites. While it may host scripts such as the jQuery Mousewheel plugin, “it does not inherently collect or analyze user interaction data unless those features are specifically enabled and configured by the site owner.” This is a lie because you can also read this:
Bot Detection: Cloudflare employs behavioral analysis techniques to identify bot-like behavior. This can include monitoring mouse movements, scrolling patterns, and other user interactions on a webpage. By analyzing these behaviors, Cloudflare can determine whether the traffic is likely coming from a human user or an automated script.
Vulnerability to Abuse: Increased data collection eventually leads to misuse by those in power. Without adequate checks and balances, personal information will be exploited for political, economic, or social gain.
Are there WordPress Plugins to Disable CloudFlare Mousewheel Code?
Ad Blockers and Browser Extensions
- While not a plugin for WordPress, users can utilize browser extensions or ad blockers that prevent tracking scripts from running, including those from Cloudflare. Examples are EFF Privacy Badger, AdBlock Plus, and NoScript.
- Plugins like WP GDPR Compliance or Complianz: These plugins help manage user consent and privacy settings, and they may provide options to disable certain scripts that track user behavior.
- Add your own JavaScript, for example to the GoogleAdSense code block which you should have removed from your site for added privacy.
// Function to disable jQuery Mousewheel pluginfunction disableMouseWheel(){ // Unbind the mousewheel event from all elements $(document).off("mousewheel"); $(document).off("DOMMouseScroll"); // For Firefox support }// Call the function to disable mouse wheel functionalitydisableMouseWheel();
Does this code work? It seems to remove CloudFlare mousewheel in some cases, but not when CloudFlare loads their code last, after your web site’s code. When external scripts, such as those from Cloudflare, are loaded last, they can re-bind mousewheel event handlers after your unbinding code has executed.
- Multiple Bindings: Also, if the mousewheel event is bound multiple times to the same element, simply calling
.off("mousewheel")may not remove all instances unless you specify the exact handler.
So, Re-apply Disabling on Load Completion
If you know that Cloudflare scripts will load last, you can set a timeout or use an event listener for when the page has fully loaded. You might add this line:
$(window).on('load', function() { disableMouseWheel();
// Disable again after all scripts have loaded
});
This did not do the job because AJAX allows CloudFlare to load code later.
CloudFlare Injection Removed
The above at first seemed to have worked. Here is a screenshot of my web site now purged of this CloudFlare injection:
However, when I removed the code to validate that it was responsible for removal of the cloudflare JavaScript injection, the CloudFlare CDN code was still gone.
What really happened is that I used Privacy Badger and blocked CloudFlare by disabling all, not just cookies from CloudFlare. When I turned that great Firefox plugin’s blocking off, the CloudFlare was still there. Privacy Badger gives a warning that blocking CloudFlare breaks some web sites, so you really need GoDaddy to remove this.
How to Check if mousewheel CloudFlare Spy is Loaded
Hit F12 and click the Console tab. Paste this code in and blindly type “allow paste” without the quotation marks.
if (typeof jQuery.event.special.mousewheel !== 'undefined') {
console.log("jQuery Mousewheel plugin is loaded.");
} else {
console.log("jQuery Mousewheel plugin is NOT loaded.");
}
Then press the [ > Run] button. In my case I once saw that it was loaded and on another run saw that it was not as the reply in the output.
As stated at the beginning, as it turned out, there was JavaScript code pointing to CloudFlare embedded in my WordPress theme which was detected by a tech at my new host and after removing that, newsi8.com was free from CloudFlare hosted code and future influence, at least on the local level, at least for now.
Oversight Needed
Most humans in positions of power need constant monitoring or they will start taking advantage. This seems to be a rule of the human condition.
To summarize, by the nature of how it operates, CloudFlare is an attack vector. It is not to be trusted.
Citations:
[1] https://www.securityweek.com/cloudflare-users-exposed-to-attacks-launched-from-within-cloudflare-researchers/
[2] https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/cloudflare-flaw-causes-potential-major-data-leak
[3] https://www.cloudflare.com/press-releases/2024/new-cloudflare-report-shows-organizations-struggle-with-outdated-security/
[4] https://www.cloudflare.com/application-services/products/securitycenter/
[5] https://www.upguard.com/security-report/cloudflare
[6] https://www.cloudflare.com/learning/access-management/rdp-security-risks/
[7] https://www.cloudflare.com/learning/security/threats/owasp-top-10/
[8] https://www.cloudflare.com/disclosure/
[9] https://blog.cloudflare.com/cloudflare-incident-on-september-17-2024/
[10] https://community.cloudflare.com/t/how-to-know-if-cloudflare-is-conneted/602379
[11] https://www.news18.com/topics/cloudflare/
[12] https://www.techdirt.com/2024/09/18/extwitters-brazil-ban-evasion-cloudflare-cdn-becomes-latest-battleground/
[13] https://blog.cloudflare.com/kiwifarms-blocked/
[14] https://money.cnn.com/2017/08/24/technology/business/cloudflare-ceo-interview-daily-stormer/index.html
[15] https://blog.cloudflare.com/cloudflare-supports-the-passage-of-the-usa-freedom-act
[16] https://blog.cloudflare.com/cloudflare-prism-secure-ciphers/
[17] https://netzpolitik.org/2015/cloudflare-deutscher-bundestag-bezieht-schon-wieder-internet-von-us-anbietern-diesmal-fuer-die-eigenen-webseiten/
[18] https://news.ycombinator.com/item?id=18476658
[19] https://www.cloudflare.com/de-de/the-net/top-of-mind-security/phishing/
[20] https://community.cloudflare.com/t/nsa-information-requests/210984
[21] https://arstechnica.com/information-technology/2014/02/making-nsa-style-spying-harder-cloudflare-offers-more-robust-web-crypto/
6 comments
Hello, sorry not leaving your comment section empty as I don’t hang out on social media…
CDN making site slower: Generally this is not the case, a CDN will make your site faster by caching assets and hopefully full pages close to you. But your site does not cache well as its giving off a PHPSESSID on the page so you can’t cache the page. If you fix this you should see a speedup in general and would also take better advantage of CDN performance. I don’t know how you did your speed testing if you could not turn off your CDN, I would really question the results though without more evidence. However that said a CDN does have the potential to make a site slower, that’s just very rare.
Safer: Yeah I mean cloudflare “could” block bad requests. They likely help with DDOS but “safer” is really not a great term as its not defined what is meant by that in this context. Safer for the user? Safer for the webserver?
More private: Well… you could potentially hide your hosting provider from website visitors. Your man in the middle is very much true though, that’s exactly what cloudflare is doing. If they decided to be evil they have access to all your traffic. Now hopefully its re-encrypted to the backend webserver. I think this is generally done so not sure why you are complaining about unencrypted traffic from Cloudflare to the webserver. Is this something that was actually done in your webhosting setup? That sounds like a misconfigured CDN if that is the case.
Good point on NSA surveillance. Yeah that’s scary they could easily have a tap at the cloudflare side. As its doing man in the middle stuff all your traffic is decrypted and (hopefully) reencrypted when its sent onward to the backend webserver if it does not hit cache. Cloudflare could easily send all that un-encrypted data to the NSA.
However the argument also falls flat in this case as Godaddy is ALSO a US based company. So any FISA order could be applied directly to them instead of Cloudflare even if you are not using a CDN. Same applies to DreamHost who appear to be your current cost (least they own the IP this site points to).
Now I agree I hate CAPTCHA’s, I know why they do them, and they do help a ton for preventing bot attacks. But they are awful for users and yes can also create fingerprinting issues. And the single point of failure I also agree, way too many sites are behind cloudflare. Some of the same issues are present in other big providers like Googles recaptcha, AWS hosting, etc. I don’t like the trend of big centralized internet. I wish people all went and bought their own servers, no more gmail, yahoo, facebook, x, etc. Everyone gets their own website, their own email, and puts it all on their own server so no one else can mess with it!
Anyway thanks for the post, the more people talk about and think about this stuff the better.
Hi Asdc,
Welcome first human comment in a century. Thanks, great points. The testing to see if a CDN was faster was during the time when I could turn it off at GoDaddy. I tried several via WordPress plugins as I recall. Great tip to look at PHPSESSID. Using PHP sessions is not standard for WordPress, so I assume it is from some plug-in, hopefully not one I wrote, or baked into my theme, which is pretty old. Will check into that. True on FISA orders on all those companies. Giving my encrypted SSL communications to CloudFlare (which annoys me with CAPCHAS) feels different because I signed up with GoDaddy and with NameCheap and DreamHost, but not with CloudFlare. Well I did once, and they are super easy to use. Great set up. Cloudflare offers a few different encyrption modes, but it decrypts the data at its edge servers for various functionalities, such as DDoS protection and Web Application Firewall (WAF) services. This means that while traffic is encrypted when it enters and potentially when it exits Cloudflare (though I think not usually), your private data is still always decrypted in transit within Cloudflare’s infrastructure. Therefore, it does not provide true end-to-end encryption as understood in traditional terms. (Ref: https://community.cloudflare.com/t/dedicated-ssl-does-it-provide-full-end-to-end-encryption/124441 unreachable). Encryption modes they offer include:
– I. Off: No encryption is used. All traffic is transmitted in cleartext HTTP.
– II. Flexible: Encrypts traffic from the browser to Cloudflare using HTTPS, but the connection from Cloudflare to the origin server is unencrypted (HTTP). This mode is suitable for origins that do not support TLS.
– III. Full: Cloudflare encrypts traffic both to and from the origin server but does not validate the origin server’s SSL certificate. If a visitor uses HTTP, Cloudflare will connect to the origin using HTTP as well.
There is a fourth option too, but I don’t like this whole situation where about 20% of the Internet now has a mandatory non-encrypted leg of the journey through part of CloudFlare. This is a big target for big surveillance. It should all be zero trust end to end. The concept of Zero Trust emphasizes the need for end-to-end encryption to protect data throughout its journey. This model assumes that breaches can occur at any point and thus requires rigorous verification of all connections. While Cloudflare promotes its Zero Trust solutions, it is basically saying “trust us”, or perhaps “pay us to un-break all that SSL security we just broke”?
Thanks again.
Right so Cloudflare does support unencrypted transit to the backend webserver. But I would expect any big company integrating it as a CDN would set it up to properly encrypt traffic to the backend server (hopefully with full validation of the backend webservers cert too). (But ask your hosting company!)
Of course Cloudflare pretty much always decrypts and re-encrypts. Cloudflare is kinda useless if it’s not doing man in the middle style work as it can’t see much about the traffic. Does “zero-trust” actually do complete end to end encryption? Its rather hard to do end to end encryption, you would basically have to rely on SNI then pipe it to the correct backend server. At which point what’s the point of your CDN? Other then perhaps acting as a basic firewall it seems like your fancy anycast IP with geo-located servers are pointless.
I would expect most shared hosting products would have other decrypt/reencryps hops or even unencrypted traffic running around the hosting providers network too. After all you generally have some kinda shared webserver/proxy that then routes to the backend hosts. The exception being old things like Cpanel/Plesk where its often run on a single box. Or some very new things that are very clever and look at the SNI then route to the correct internal webserver for decryption never having to touch unencrypted traffic. Only way to be sure is to ask the hosting company (and trust them) or run your own server and keep control of your SSL certs.
Yeah, I relate to your point, you signed up to trust GoDaddy with your traffic not Cloudflare. Using an external vender and giving them your SSL cert is not what you expected when you signed up. Would be nice if they made this clear (no clue when/if this was ever mentioned when you signed up for hosting but sounds like they just added it on you without telling you).
Giving Cloudflare such a large chunk of the internet is worrysome. It gives Cloudflare a ton of power. If they decide they don’t like you they can block you from a large number of sites all at once. I pretty much always use a VPN and as of today they just bug me with captcha’s. But if one day they decide they don’t like the VPN at all it would be a huge headache to get around as I can’t simply avoid all the sites they control.
Same thing bothers me in other arena’s like Plaid in financial companies. Many of the “fintech” providers just use Plaid under the hood which is very much not who you expect to handle your sensitive data when you sign up with a different company.
As a final note, doing a speedtest within WordPress is likely not gonna show you the benefit of Cloudflare. To really see the benefit it can provide you need to load all the assets, hopefully a long ways from the webserver, with the Cloudflare node already caching at the very least the asset content. So for best case take a speedtest from some server at least a ways from your server, perhaps in another continent. Run it once to prime everything then run the test. Should be a huge decrease in total load time even without the page caching. With the page caching it would be even better. But if you start from cold you should see little to no benefit. It all works best when you have a steady stream of visitors to your site as its all about getting content from cache that the guy before pulled from the webserver. For the first cold page load you should see little to no difference and it might even be slightly slower. Unless Cloudflare has a better route to get you to the backend server quicker, which is possible as they have a huge network of fiber as well with their backbone. They really are eating the internet, imagine a world where you have to pay Cloudflare to get to some parts of the internet at a reasonable speed if they take over enough fiber? Cloudflare is really too big, it would be better if less people used them and picked some other CDN provider or none at all (though DDOS protection/etc is hard on a small website, Cloudflare provides a huge benefit for free/cheap)
Good points once again, but I strongly disagree that decryption should be happening anywhere between your web browser and the server you are communicating with. It’s not necessary and I think it is a looming silent disaster for human rights. CDNs cache content, which means they store static resources (like images, style-sheets, and scripts) for quick access. However, a CDN does not interpret or alter the content itself. CloudFlare is doing free “security” on top of CDN. How do they make money doing all of this at no cost? Could it be that our bulk decrypted (once secure) data is being sold? Seems crazy and unlikely, but it is not technically impossible. Here’s one “out in the open” way CloudFlare makes money: the Cybersecurity and Infrastructure Security Agency (CISA) awarded Cloudflare a $7.2 million contract to provide DNS services for .gov domains.
It seems from what I’ve read (I haven’t asked GoDaddy because I stopped using them), securing your traffic end-to-end is impossible with CloudFlare, and GoDaddy knows it. When using Cloudflare with GoDaddy Managed WordPress Hosting, the default SSL/TLS mode is typically set to Flexible. This mode encrypts traffic between the user and Cloudflare but does not encrypt the connection between Cloudflare and the origin server (GoDaddy). This is a huge security vulnerability. Reports indicate users can not achieve Full (Strict) mode due to limitations in GoDaddy’s Managed WordPress hosting, which may not allow third-party SSL certificates or specific configurations necessary for this mode1.
Cloudflare acts as a man-in-the-middle using SSL offloading. This practice raises concerns about privacy. Other CDNs offer SSL offloading as well. To me this is like saying some banks offer having outside businesses hold your safe deposit box keys. That’s not something I’d choose to use, and not something that should be allowed to be offered. I see SSL offloading as a form of wiretapping or at the very least severe network security negligence. I think there is a misconception (“Cloudflare pretty much always decrypts and re-encrypts,”) as traffic monitoring does not solely depend on packet content but also on packet routing. Cloudflare can effectively stop DDoS attacks and bots without needing to read sensitive information like bank account passwords. Implementing mutual TLS (mTLS) for secure connections can allow a network security provider to inspect traffic without exposing sensitive data.
Correct zero trust implementations ensure end-to-end encryption, where only the client and server can decrypt data. This means that even if a CDN caches content, it cannot read or manipulate it. A White House Executive Order (EO 14028) issued in January 2022 mandates a zero trust approach as a best practice for modern cybersecurity programs across sectors, emphasizing that HTTP traffic must be encrypted to safeguard data in transit. Cloudflare’s SSL offloading services enable decryption at their edge servers, allowing them to perform “security checks and optimizations” (aka spying) before re-encrypting traffic to users. However, this decryption process can expose user data to potential internal threats within Cloudflare, raising concerns about data privacy and regulatory compliance with laws such as HIPAA, GDPR, and CCPA. Instead of decrypting data, CDNs can filter requests based on patterns or behaviors indicative of malicious activity. Rate limiting and throttling policies can be applied based on request rates or patterns without inspecting payloads, helping to mitigate DDoS attacks or abusive behavior. Web Application Firewalls (WAFs) can also analyze traffic patterns and enforce security policies without decrypting traffic, working in tandem with CDN services.
I don’t think people realize the overreach happening and the future implications. To use a medical analogy, Dr. Cloudflare is requiring we give blood for genetic analyses for them to do the simple job of monitoring our blood pressure.
Perhaps someone with more real world current network security job experience will explain any errors in my views here, but this is what I currently believe to be correct.
I don’t see how you can do any caching without decryption. If you don’t decrypt you don’t know anything about the request beyond SNI* (hostname being asked for). You don’t know what page they are asking for, and even if you did you likely can’t send the encrypted blob to anyone else without re-encrypting as modern cyphers like diffie hellman negotiate a new encryption key on every connection. So no having your cake and eating it too. You gotta pick secure transport all the way to the backend server or caching on a CDN but not both.
As far as rate limiting/DDOS/DOS/etc prevention its much improved with decryption as well. Sure you can do some simple things without it, but without even knowing what pages/etc are being requested its much harder to be effective in blocking bots without blocking any humans.
All to say, there are very good reasons to do the decrypt/re-encrypt cycle. But not to take away from your point you are then completely trusting Cloudflare with the keys to the kingdom. They have your SSL cert and can do anything they want with incoming requests. I don’t know of any CDN’s that try and pass through requests without decrypting and think they would be very limited in their application if they did.
I only briefly glanced at EO 14028, not sure what it says about the matter. But from a purely technical point of view I just don’t see how end to end encryption could play nicely with caching for web requests. I mean you could do something very non-standard like give all the headers then an encrypted blob then give all the clients the same key to decrypt said blob. Do a bunch of stuff in javascript… Sure you could hide parts of the website or important data or what not, but you still have to let the CDN know the file you want or it can’t cache it for you.
* Actually as far as SNI goes Cloudflare is pioneering the way to encrypted SNI so no one else along the chain can see what website you are asking for.
Thank you, Some current realities are very different than I have assumed. I was wrong on a critical detail: SSL/TLS encrypts data transmitted over the network, including HTTP headers and body content. This encryption means a caching proxy or server cannot return needed content in response to requests without decrypting SSL first. Useful caching mechanisms must rely on reading this data and therefore require decryption capabilities. It makes sense. If non-encrypted traffic included the resource(s) (URIs) you wanted on a server, that would not be good privacy.
For encryption end-to-end, historically, many CDN providers offered shared SSL certificates, which required website owners to upload their private keys to the CDN. This practice poses significant security risks since sharing private keys undermines the fundamental principles of public key cryptography. One study examined 10,721 websites using HTTPS with CDNs and found that 68.8% of these sites displayed invalid certificate warnings [https://www.ieee-security.org/TC/SP2014/papers/WhenHTTPSMeetsCDN_c_ACaseofAuthenticationinDelegatedService.pdf]. Thus, a significant portion of CDN implementations may not adhere to proper SSL configurations, leading to trust issues with HTTPS.
Back-End Communication: Some CDNs, like Cloudflare, will use HTTP instead of HTTPS for back-end communication, which can expose vulnerabilities to man-in-the-middle (MITM) attacks. Even when using HTTPS, they may not always perform proper authentication, further compromising security. Thus, some trust issues with HTTPS are justified. If you see the green lock icon and words telling you your communication is secure, but your server uses Cloudflare or another CDN, that assurance of security may be untrue. The way SSL is supposed to work is thus significantly broken. 27% of all websites utilized a CDN as of 2021. Among the top 1,000 websites, CDN usage was notably higher, with 80.5% of those sites employing CDN services. Wow. [https://almanac.httparchive.org/en/2021/cdn]
So SNI is not typically encrypted and I wrongly assumed that is all you need to cache content. While the SNI (Server Name Indication) provides information about which hostname a client is trying to connect to, it is limited. SNI sent during the TLS handshake does not include details such as HTTP methods or paths. Thus, without decrypting the traffic, a caching mechanism can only make decisions based on SNI, which is insufficient for effective caching. The introduction of encrypted SNI (ESNI) further complicates matters by encrypting the SNI field itself, making it impossible for intermediaries to see even the hostname being accessed. This means that if ESNI is used, not only is the content encrypted, but also the information needed to make caching decisions based on hostnames is hidden from any proxies or firewalls that do not have decryption capabilities. Seems like a mess.
The solution is clear: move an encoded copy of the paths into ESNI and keep the rest of the content encrypted so the CDN can never see it. In other words, have two separate containers of encryption and give the least amount of information necessary, on a need-to-know basis.
In RFQ development for CDNs I assumed others would have thought of this. Still feeling some shock about it. How could HTTPS not have been designed with CDNs in mind for Zero Trust for all these years? What I found is that the original design of HTTPS did not fully account for the multi-tenant nature of CDNs. Large CDNs have multiple servers (at times in different locations) and (shockingly) your traffic hops around between them unencrypted. (Gee, where would a hacker sneak in a tap?). This is all because “managing SSL/TLS certificates across numerous CDN nodes can be cumbersome” which is true. Each node (eg server) must have valid certificates to ensure secure connections, which can lead to configuration errors or lapses in security if not maintained properly. Well, we could make CDNs pay for and manage all of those certs, make it mandatory for each node, by regulation, with severe fines. You are still trusting the CDN in this scenario, but at least they are acting in a trustworthy manner by honoring the spirit of SSL.
In other words, I suggest we BAN the SSL lock icon on all web browsers unless web users are getting true end-to-end SSL! Make the lock icon true again!