lntl@lemmy.ml to Privacy@lemmy.mlEnglish · 19 days agoI imagine that instead of beating TLS, state actors work with Cloudflare and the other CDNs who terminate the connection to listen in.message-squaremessage-square19linkfedilinkarrow-up164arrow-down11file-text
arrow-up163arrow-down1message-squareI imagine that instead of beating TLS, state actors work with Cloudflare and the other CDNs who terminate the connection to listen in.lntl@lemmy.ml to Privacy@lemmy.mlEnglish · 19 days agomessage-square19linkfedilinkfile-text
minus-squaredeadbeef79000@lemmy.nzlinkfedilinkarrow-up37arrow-down1·19 days agoThe CDN’s are the MitM.
minus-squareScoffingLizard@lemmy.dbzer0.comlinkfedilinkarrow-up1·9 days agoWhat exactly are the CDNs?
minus-squaredeadbeef79000@lemmy.nzlinkfedilinkarrow-up1·9 days agoThe Man in the Middle (MitM). I.e. if they’re terminating TLS and then forwarding to your TLS servers then they are capable of inspecting all the traffic to and from your service. This is exactly what a MitM attack in is.
minus-squareScoffingLizard@lemmy.dbzer0.comlinkfedilinkarrow-up1·5 days agoWhat if we just blocked all the cdns? I think I’ve locked a few out of my domain.
minus-squareScoffingLizard@lemmy.dbzer0.comlinkfedilinkarrow-up2·8 days agoThis sounds like it defeats the purpose of a private DNS. At least there is VPN.
minus-squaredeadbeef79000@lemmy.nzlinkfedilinkarrow-up1·8 days agoA VPN isn’t going to protect you from CloudFlare being compromised and you’ll never even know. Likewise a private DNS will still be resolving to the CF addresses.
The CDN’s are the MitM.
What exactly are the CDNs?
The Man in the Middle (MitM).
I.e. if they’re terminating TLS and then forwarding to your TLS servers then they are capable of inspecting all the traffic to and from your service.
This is exactly what a MitM attack in is.
What if we just blocked all the cdns? I think I’ve locked a few out of my domain.
This sounds like it defeats the purpose of a private DNS. At least there is VPN.
A VPN isn’t going to protect you from CloudFlare being compromised and you’ll never even know.
Likewise a private DNS will still be resolving to the CF addresses.