#Cloudflare now blocks all unencrypted traffic to its API endpoints
Recent searches
Search options
#cloudflare
13 posts11 participants0 posts today
@Jdm2@boriken.socialI’ve been struggling with this with one RSS feed while making @notibotPR. It’s a thing apparently.
https://openrss.org/blog/using-cloudflare-on-your-website-could-be-blocking-rss-users
openrss.orgUsing Cloudflare on your website could be blocking RSS usersCloudflare's security features could be blocking RSS feed users from accessing your website
Here's hoping the scrapers will just slop it up!
Cloudflare turns AI against itself with endless maze of irrelevant facts
@sqrtminusone@bsd.cafeI'm just thinking...
In principle, #Cloudflare could make a lot of money by discreetly selling bypass tokens for their anti-scraping protection to AI corps.
@jan@kcore.orgI was having a look at how to offer a CNAME record on the apex (root) of a domain. On #cloudflare that's supported through their CNAME flattening, but I'm wondering how it actually works.
I'm seeing a HTTPS record being created, but the values are rather opaque to me. Not entirely sure how to recreate this at another #dns provider.
@sqrtminusone@bsd.cafe...And another one gone, and another one gone...
@kkarhan@infosec.space@kubikpixel except #CloudFlare is #poison to the #Internet, as their business model is a #RackerteeringScheme against their own #clients, as they proudly host #CyberCrime and #Terrorism!
- Their entire #ASN should be banned as a matter of principle!!!
Cloudflare turns AI against itself with endless maze of irrelevant facts - On Wednesday, web infrastructure provider Cloudflare announced a new featu... - https://arstechnica.com/ai/2025/03/cloudflare-turns-ai-against-itself-with-endless-maze-of-irrelevant-facts/ #largelanguagemodels #machinelearning #aisecurity #cloudflare #biz #ai
Ars Technica · Cloudflare turns AI against itself with endless maze of irrelevant facts
The game does not start now but this new player is there:
»Cloudflare builds an AI to make life hell for other AIs.
Slop-making machine will feed unauthorized scrapers what they so richly deserve, hopefully without poisoning the internet«
https://www.theregister.com/2025/03/21/cloudflare_ai_labyrinth/
The Register · Cloudflare builds an AI to lead AI scraper bots into a horrible maze of junk content
@kkarhan@infosec.space@Viss Eeyupp.
If I did shite like this, I can be glad If I end up in a room questioned by #BKA & @bsi and given the offer to call a lawyer...
- #CloudFlare most likely violated §202a & §202b penal code in #Germany and I hope https://wbs.legal and @noybeu start sueing them for that!
WBS.LEGALWBS.LEGAL | Rechtsanwälte bundesweitIhre Kanzlei für Internetrecht und Medienrecht: WBS.LEGAL (ehemals Wilde Beuger Solmecke) - Bundesweit aktiv - Wir helfen Ihnen gerne!
@kkarhan@infosec.space@cR0w @troyhunt @dangoodin @benjojo @Viss @matthew_d_green
Seriously, #ClownFlare are at best a #ValueRemoving #MITM and more often than not a #RogueISP who's business model is a #RacketeeringScheme that should not exist to begin with.
- There is no legitimate reason to use #Cloudflare!
Hackers know half of passwords entered online, #Cloudflare finds
https://cybernews.com/security/half-login-attempts-use-compromised-password/
@kkarhan@infosec.space@kajer #CloudFlare is a #RogueISP and their "business" is at best #ValueRemoving #rentseeking but mire iften than not just a digital #RacketeeringScheme!
@kkarhan@infosec.space@Viss #CloudFlare is a #RogueISP known to offer Services in #Russia and to #CyberCriminals...
#ClownFlare is also a #ValueRemoving #rentseeker who's core product / service is essentially a #Racketeering Scheme and should not exist as any competent hoster offers #DDoS protection free of charge...
@pixelcode@social.tchncs.de#Cloudflare admit they steal visitors' passwords on websites “protected” by Cloudflare – but, don't worry, “for science” 
QT @0xF21D
https://infosec.exchange/@0xF21D/114178659343887260
Infosec ExchangeRobert [KJ5ELX] :donor: (@0xF21D@infosec.exchange)So, Cloudflare analyzed passwords people are using to log in to sites they protect and discovered lots of re-use.
Let me put the important words in uppercase.
So, CLOUDFLARE ANALYZED PASSWORDS PEOPLE ARE USING to LOG IN to sites THEY PROTECT and DISCOVERED lots of re-use.
[Edit with H/T: https://benjojo.co.uk/u/benjojo/h/cR4dJWj3KZltPv3rqX]
https://blog.cloudflare.com/password-reuse-rampant-half-user-logins-compromised/
#cloudflare #password #cybersecurity
@0xF21D@infosec.exchangeRecently I boosted a couple of links about cloudflare doing some sort of password re-use analysis on passwords they saw through their WAF. This was not a technical post. It was a call to attention. Some of the responses I got suggested that my post was misleading or blowing this way out of proportion. I assure you that neither of these are true.
Don't focus so much on the idea that #cloudflare has access to passwords that come through their systems. In better times I'd welcome such an effort. At least they didn't chastize someone who really loved a silly movie, like Netflix did long ago. Instead, focus on the fact that they are a company based in the United States meaning they are subject to the whim of a fascist regime that is proving it doesn't care about the letter of the law.
I'm not concerned about my password security for the sites that transit their service. I am a cishet middle class white male. I'm pretty low on the target list.
*** I AM concerned about the password security for at risk populations who access sites crucial for them, that transit through cloudflare. I'm concerned about the LGBTQIA+ population in the United States. I'm concerned about pregnant women. I'm concerned about Jews, and Muslims, and Bhuddists, and everyone else who doesn't fit into the narrow worldview of the fascist reich that is the republican party and their bootlickers. The FBI, Justice Department, State Department, etc no longer serve the american people. They serve an emperor. This is a time of great danger any website or service that attracts at risk populations should seriously consider if using some of cloudflare's features is worth it, or if they should take their business elsewhere.
I really don't get the noise about #Cloudflare analysing traffic. Of course they do, that's a big chunk of their business! And I thought it was widely-known that they terminate TLS connections, so they could look at the contents. How is all of this suddenly so surprising to everyone?
@0xF21D wrote: "[...] something we technically knew was going on before but didn't consciously consider a threat, until now."
I've been warning for CDN's like Cloudflare and Fastly (and cloud providers in general) for a long time.
Here's a recent toot (in Dutch, the "translate" button should do the job): https://infosec.exchange/@ErikvanStraten/114042082778156313.
If you trust Google to translate it (guaranteed NOT error-free, it *may* work in other browsers than Chrome): https://infosec-exchange.translate.goog/@ErikvanStraten/114042082778156313?_x_tr_sl=nl&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp [infosec-exchange.translate.goog]
P.S. Fastly knows your https://infosec.exchange login credentials.
Infosec ExchangeErik van Straten (@ErikvanStraten@infosec.exchange)Attached: 1 image
Risico Cloudflare (+Trump)
🌦️ Achter Cloudflare
Steeds meer websites zitten "achter" het Amerikaanse bedrijf Cloudflare. Stel u opent https://pvv.nl (let op, daar staat https:// vóór, Mastodon verstopt dat) in uw browser:
browser <-1-> Cloudflare <-2-> https://pvv.nl
⛓️💥 Géén E2EE
Bij zeer veel websites (https://pvv.nl is een voorbeeld) is er sprake van twee *verschillende* verbindingen, dus beslist geen E2EE = End-to-End-Encryption (voor zover dat überhaupt nog wat zegt als de "echte" een cloud-server van Google, Microsoft of Amazon is).
🕋 CDN's
Cloudflare, een CDN (Content Delivery Network), heeft een wereldomspannend netwerk met "tunnel"-servers in computercentra van de meeste internetproviders. Waarschijnlijk ook bij u "om de hoek".
🔥 DDoS-aanvallen
Dat is werkt uitstekend tegen DDoS (Distributed Denial of Service) aanvallen. Ook zorgen CDN's voor veel snellere communicatie (mede doordat plaatjes e.d. op een web van servers "gecached" worden) - ook als de "echte" server aan de andere kant van de wereld staan.
🚨 Nadelen
Maar dit is NIET zonder prijs! Cloudflare kan namelijk *meekijken* in zeer veel "versleuteld" netwerkverkeer (en dat zelfs, desgewenst, wijzigen).
🚦 Nee, niet *u*
Ook kunnen Cloudflare-klanten allerlei regels instellen waar bezoekers aan moeten voldoen, en hen als "ongewenst" bezoek blokkeren (ook *criminele* klanten maken veelvuldig gebruik van deze mogelijkheid, o.a. om te voorkómen dat de makers van virusscanners nepwebsites op kwaadaardige inhoud kunnen checken).
Aanvulling 14:39: { zo kan ik, met Firefox Focus onder Android, https://cidi.nl *niet* openen, ik zie dan een pagina waarin o.a. staat "Even geduld, de website van Centrum Informatie en Documentatie Israël (CIDI) is aan het verifiëren of de verbinding veilig is. Please unblock challenges.cloudflare.com to proceed."
}
😎 Men In Black
Omdat Cloudflare een (tevens) in de VS gevestigd bedrijf is, moeten zij voldoen aan de Amerikaanse FISA section 702 wetgeving. Dat betekent dat hen opgedragen kan worden om internetverkeer te monitoren, en zij daar een zwijgplicht over hebben. Terwijl Amerikanen al minder privacy-rechten hebben dan Europeanen, hebben *niet*-Amerikanen *nul* privacyrechten volgens genoemde FISA wet.
🔓 Knip
Dat https-verbindingen via Cloudflare niet E2EE zijn, blijkt uit onderstaand plaatje (dat vast méér mensen wel eens gezien hebben).
📜 Certificaten en foutmeldingen
Dat plaatje kan, zonder certificaatfoutmeldingen, ALLEEN bestaan als Cloudflare een geldig authenticerend website-certificaat (een soort paspoort) heeft voor, in dit geval, https://bleepingcomputer.com - en dat hébben ze. Voor MILJOENEN websites.
🛃 MitM
Cloudflare (maar ook anderen, zoals Fastly) zijn een MitM (Man in the Middle).
🤔 De tweede verbinding?
Uw browser heeft, grotendeels transparant, een E2EE-verbinding met een Cloudflare server. U heeft géén idee wat voor soort verbinding Cloudflare met de werkelijke website heeft (is dat überhaupt https, en een veilige variant daarvan? Wat doet Cloudflare als het certificaat van de website verlopen is? Etc).
👽 AitM
En zodra een MitM kwaadaardig wordt, noemen we het een AitM (A van Attacker of Adversary).
🗽 Trump
Als Trump Cloudflare opdraagt om geen diensten meer aan NL of EU te leveren, werkt hier HELEMAAL NIETS MEER en dondert onze economie als een kaartenhuis in elkaar.
🃏 DV-certs
Dat Cloudflare een website-certificaat voor bijvoorbeeld https://vvd.nl of https://cidi.nl heeft verkregen, zou vreemd moeten zijn. Dit is echter een peuleschil "dankzij" DV (Domain Validated) certificaten (het lievelingetje van Google) die het internet steeds onveiliger maken en waar ook onze overheid "voor gevallen is" (zie https://infosec.exchange/@ErikvanStraten/114032329847123742).
😱 Nepwebsites
Maar dit is nog niet alles: steeds meer criminele nepwebsites *verstoppen* zich achter Cloudflare, waar zijzelf (crimineel) geld aan verdient. Zie bijvoorbeeld https://security.nl/posting/876655 (of kijk eens in het "RELATIONS" tabblad van https://www.virustotal.com/gui/ip-address/188.114.96.0/relations en druk enkele keren op •••).
#Risico #Economie #Cloudflare #Fastly #CDN #AitM #MitM #FISASection702 #FISA #ThreeLetterAgencies #Trump #Sbowden #E2EE #InfoSec #VVD #PVV #CIDI #VT #VirusTotal #DVCerts #DV #OV #EV #QWAC #CyberCrime #NepWebsites #FakeWebsites
This is an important bit in the #Cloudflare post (emphasis mine):
"Our data analysis focuses on traffic from Internet properties on Cloudflare’s free plan, which *includes leaked credentials detection as a built-in feature.*"
"Our data analysis focuses on traffic from Internet properties on Cloudflare’s free plan, which *includes leaked credentials detection as a built-in feature.*"
@0xF21D@infosec.exchangeSo, Cloudflare analyzed passwords people are using to log in to sites they protect and discovered lots of re-use.
Let me put the important words in uppercase.
So, CLOUDFLARE ANALYZED PASSWORDS PEOPLE ARE USING to LOG IN to sites THEY PROTECT and DISCOVERED lots of re-use.
[Edit with H/T: https://benjojo.co.uk/u/benjojo/h/cR4dJWj3KZltPv3rqX]
https://blog.cloudflare.com/password-reuse-rampant-half-user-logins-compromised/
benjojo.co.ukbenjojo:It feels quite uncomfortable that cloudflare is somewhat openly admitting to analysing login credentials that are going through the reverse proxy, and providing...