Source
r/Bitcoin•
stuffthatmattered

Cloudflare, ddos, US juristiction

Hi, I've noticed a number of bitcoin services use cloudflare.

As I understand for an ssl website you have to pretty much give them the keys and or allow them to issue new ones for even easier setup.

This is cool from an operations point of view but not so cool from a jurisdiction point of view and it is mitm.

What do we think about this?

Not really an issue? Or perhaps we should avoid websites on cloudflare?

Alternatives for ddos?

Posted Oct 14, 2013, 6:01 PM UTC

2326
jgarzik•

Yes, this is an issue.

17
stuffthatmatteredOP•

Thanks, glad you agree. We should think of something other than mod_security alone as a guide.

5
[deleted]•

[deleted]

1
jgarzik•

Expand the scope of your horizon beyond one site. If most major bitcoin sites are protected by CloudFlare, that introduces community-wide SSL key risk and single-vendor risk.

1
[deleted]•

[deleted]

1
jgarzik•

Use your brain. You upload a specific key for each site to CloudFlare. If CloudFlare gets compromised, many bitcoin sites are compromised.

2
[deleted]•

[deleted]

-1
samsonx•

A lot of people think CloudFlare is an NSA operation.

13
Vibr8gKiwi•

As were the ddos attacks that drove sites to use CloudFlare.

10
throwaway-o•

It'd be the PERFECT way to filch SSL certificates from people willing to give them the certs. Even if they are not a NSA front, the courts can just steal the certs with a secret court order, Lavabit style, and to think that hasn't happened yet is extremely naive. CloudFlare is essentially the easiest way to MITM yourself.

5
[deleted]•

[deleted]

3
runeks•

I'm going to use CloudFlare for a website of mine. Free bandwidth. I wouldn't use it for a site with secure content though.

1
throwaway-o•

When they use your own service to plant malicious JavaScript in your browser and own your machine through FoxAcid, let me know.

2
runeks•

How about you let me know? If you can prove one instance of this happening from my website I'll give you a bitcoin.

1
throwaway-o•

I think a reasonable person who knows such exploit systems are out there in the wild would accept the proposition that such systems can target them.

I think your request for extraordinary evidence is unreasonable and certainly not worth only one bitcoin. Maybe if I worked at the NSA I would own your machine for proof, but only for over 25 bitcoins.

Forgive me, but I decline.

0
stuffthatmatteredOP•

Do you think it would be OK to use CDNs for non JavaScript statics like pngs and say CSS?

I want to understand what is the safest

1
throwaway-o•

The safest is to not post CDN content. Second safest is to post your own CDN content, either with server-side intelligence to post the appropriate URLs or with anycast DNS.

Key points: Any of the CDN companies you might use are in the U.S. or subject to be bossed around by tyrannical old farts wearring black mumus from the U.S. You must never ever surrender your certificates, ever, to anyone. Ever.

Suppose you forego CDNs. With JS and CSS compaction, and proper "static" content client-side caching, and enough RAM on your edge servers / frontends, you can always afford the extra 400 milliseconds or so that takes for your users not to be compromised.

As always, minimizing the amount of computation your servers must do to respond to a request will help you with both regular costs and with DDoS protection costs.

My credentials: I work doing site reliability engineering for a very large company whose services you deliberately use every day multiple times a day.

2
Deafboy_2v1•

Yes. Someone will get burned sooner or later.

2
[deleted]•

[deleted]

1
stuffthatmatteredOP•

No?

1
smyger•

Whats not cool about it? Can someone ELI5?

1
stephenwraysford•

Cloudflare is what's called a Content Distribution Network (CDN). Cloudflare has servers in datacenters distributed throughout the world, and uses clever networking to mitigate the effects of denial of service attacks by routing attacks to other places on its network. This is useful for websites such as 4chan that are routinely attacked, and many large-traffic sites use Cloudflare's massive capacity to serve customers 24/7.

In order to use Cloudflare's protection, you effectively need to move your site and its content into their datacentres. In doing so, if your site is secured with SSL (uses https), you need to turn over your SSL private key to Cloudflare.

Think of SSL as a clever way of exchanging a message between two people without anyone else being able to read it. You write a message on a piece of paper, put the page in a box and put a padlock on the box, to which only you have the key. You then send your friend the box. Your friend can't open it, because they don't have your key. They then put their own padlock on the box, to which only they have the key, and send the box back to you. You remove your padlock and send the box back to your friend, who removes their padlock and reads the message. At no point has the box been in the post without at least one padlock on it. This is the basis of "private key cryptography," and SSL. Another feature of SSL is that you use a 'trusted third party' (a CA or Certificate Authority) to verify that your private key is genuine. This stops bad people impersonating you by creating another private key and saying it's yours. Unless they steal your private key, it is difficult (although not impossible, but that's another conversation) to make a clone of a private key.

Now, you can see why it is bad for Cloudflare to have your SSL private key, because they are now in charge of creating messages with your key.

Some people believe that Cloudflare is an NSA front, or at the very least because they are an American company, can be compelled to hand over anyone's private keys to them. This would allow them to not only pose as you, but also to decrypt information stored on your site, be that email, private messages, transaction details or other private information. In the Bitcoin world where privacy, anonymity and transparency are extremely important, this presents a big problem.

10
jargoon•

According to statements from their CEO, it looks like they're under a the same gag order as other tech companies (which means they've been served with requests).

http://www.washingtonpost.com/blogs/the-switch/wp/2013/09/12/cloudflare-ceo-says-insane-nsa-gag-order-is-costing-u-s-tech-firms-customers/

10
[deleted]•

[deleted]

1
xaoq•

It's a USA based company. That's pretty much the only downside of their service.

The legal jurisdiction makes it very bad, which is a shame because otherwise they're damn awesome.

4
muckraker2•

They are like the butler and have access to all datas flowing in and out of the site.

1
feonix83•

Other CDN's (at least one I know of) do this too, EdgeCast for example, although they will allow you to supply an SSL, they make it more financially reasonable to have them get one issued.

1
pardax•

Even if they don't use Cloudflare, I would never feel safe with them. Most of these websites aren't even secure at the application level, so I wouldn't expect them to be secure at the system or network level. But yes, this is an issue, thanks for raising awareness.

1
stuffthatmatteredOP•

Care to elaborate? Which sites do you consider safe or safer?

1