undefined | Better HN

0 pointslinkregister11d ago0 comments

It's within the realm of possibility that NSA is collecting data with Cloudflare's consent. It seems unlikely that Cloudflare would jeopardize their entire business model over it. Unlike other companies in the leaked NSA slides that participated in PRISM, Cloudflare would face a near-total loss of customers. Their entire value proposition is being an unobtrusive traffic intermediary.

0 comments

fph10d ago

Within the realm of possibility? Let's be honest, if you are a top NSA executive and you couldn't find a way to get your hands on Cloudflare's private keys (bribing or threatening the right person), you are not getting your Christmas bonus.

nly10d ago

It is of course inconceivable that the NSA do not have the private keys for dozens of browser trusted certificate authorities

That nonetheless doesn't help them unless they are doing active MITM. In order to do that they'd have to have at least some physical presence at Cloudflare or on the path to Cloudflare.

RealityVoid10d ago

My understanding is that they tapped communication nodes before. I would be surprised if they can't tap the pipes to cloudflare.

fragmede10d ago

I mean, it is the CIA, but if you encrypt it before it leaves the box, and you're decent good with the key material, how are they going to get at it? Tapping the fiber then gets them encrypted flows, which isn't nothing, but, well, it would be surprising if they had access to the clear text.

1 more reply

linkregisterOP10d ago

Is this information derived from Enemy of the State starring Will Smith and Gene Hackman? It was a great movie and the first DVD I ever bought.

philipallstar10d ago

Do people in government get bonuses linked to performance?

sph10d ago

Government agencies get budgets linked to performance.

philipallstar10d ago

Well - do they? In my experience they get budgets for spending their current budget.

sph11d ago

> Unlike other companies in the leaked NSA slides that participated in PRISM, Cloudflare would face a near-total loss of customers

People didn’t care when they learned about PRISM, why would they care now when it’s a known fact? The sane stance would be to assume Cloudflare is in cahoots with NSA.

linkregisterOP10d ago

All the companies involved in PRISM made public statements saying they ceased participation. Google undertook a costly initiative to add encrypted connections over their datacenter circuits. The NSA leaks were a forcing function that led to a massive uptake of encryption. Up until that point it was common for websites to support only HTTP.

The NSA leaks dominated news cycles for the entirety of 2013.

netdevphoenix10d ago

> All the companies involved in PRISM made public statements saying they ceased participation. Google undertook a costly initiative to add encrypted connections over their datacenter circuits

This is as helpful as Whatsapp's so called E2E encryption comms (that just happens to not be applicable by default in certain situations).

fragmede10d ago

What are those certain situations?

1 more reply

lukewarm70710d ago

my llm api traffic terminates tcp at cloudflare in lovely plain text :/

it does give better peering. reduces latency a bit for me.

my-next-account10d ago

I had no idea that this was a thing. How can you figure out where SSL turns into plain text on its route to the destination?

1 more reply

netdevphoenix10d ago

> Cloudflare would face a near-total loss of customer

I think more people than you would expect would be happy to accept that as the price for protection against malicious actors

luxuryballs10d ago

anybody remember Lavabit?

j / k navigate · click thread line to collapse

0 comments

fph10d ago

nly10d ago

It is of course inconceivable that the NSA do not have the private keys for dozens of browser trusted certificate authorities

That nonetheless doesn't help them unless they are doing active MITM. In order to do that they'd have to have at least some physical presence at Cloudflare or on the path to Cloudflare.

RealityVoid10d ago

My understanding is that they tapped communication nodes before. I would be surprised if they can't tap the pipes to cloudflare.

fragmede10d ago

1 more reply

linkregisterOP10d ago

Is this information derived from Enemy of the State starring Will Smith and Gene Hackman? It was a great movie and the first DVD I ever bought.

philipallstar10d ago

Do people in government get bonuses linked to performance?

sph10d ago

Government agencies get budgets linked to performance.

philipallstar10d ago

Well - do they? In my experience they get budgets for spending their current budget.

sph11d ago

> Unlike other companies in the leaked NSA slides that participated in PRISM, Cloudflare would face a near-total loss of customers

People didn’t care when they learned about PRISM, why would they care now when it’s a known fact? The sane stance would be to assume Cloudflare is in cahoots with NSA.

linkregisterOP10d ago

The NSA leaks dominated news cycles for the entirety of 2013.

netdevphoenix10d ago

> All the companies involved in PRISM made public statements saying they ceased participation. Google undertook a costly initiative to add encrypted connections over their datacenter circuits

This is as helpful as Whatsapp's so called E2E encryption comms (that just happens to not be applicable by default in certain situations).

fragmede10d ago

What are those certain situations?

1 more reply

lukewarm70710d ago

my llm api traffic terminates tcp at cloudflare in lovely plain text :/

it does give better peering. reduces latency a bit for me.

my-next-account10d ago

I had no idea that this was a thing. How can you figure out where SSL turns into plain text on its route to the destination?

1 more reply

netdevphoenix10d ago

> Cloudflare would face a near-total loss of customer

I think more people than you would expect would be happy to accept that as the price for protection against malicious actors

luxuryballs10d ago

anybody remember Lavabit?

j / k navigate · click thread line to collapse