← Back to context

Comment by pocksuppet

5 hours ago

The hidden cost, of course, is that the NSA learns everything there is to know about you and your customers. Cloudflare is the LG TV of websites, but it's worse because we've known it has an always-on microphone and speech-to-text for over a decade and we still keep using it for some reason.

52 comments

pocksuppet

Reply
esperent  5 hours ago

> The hidden cost, of course, is that the NSA learns everything there is to know about you and your customers

You're replying to a comment talking about migrating from Google, so I assume you're claiming this is more of a risk with Cloudflare than Google (or other American providers like AWS)?

If so, what's your source for that claim?

  • icantevenhold  2 hours ago

    Heck the NSA backdoored our head of states phones - if “NSA wants my data” is your threat model you are pretty much cooked everywhere. Even if you host on your own server and operate everything yourself it’s no big secret that the NSA is listening in on the node/isp level

    • mitxela  2 minutes ago

      You may as well make them work hard to get it. The NSA can only get metadata from your ISP.

    • TallGuyShort  1 hour ago

      "The “threat model” section of a security paper resembles the script for a telenovela that was written by a paranoid schizophrenic: there are elaborate narratives and grand conspiracy theories, and there are heroes and villains with fantastic (yet oddly constrained) powers that necessitate a grinding battle of emotional and technical attrition. In the real world, threat models are much simpler (see Figure 1). Basically, you’re either dealing with Mossad or not-Mossad. If your adversary is not-Mossad, then you’ll probably be fine if you pick a good password and don’t respond to emails from ChEaPestPAiNPi11s@virus-basket.biz.ru. If your adversary is the Mossad, YOU’RE GONNA DIE AND THERE’S NOTHING THAT YOU CAN DO ABOUT IT. The Mossad is not intimidated by the fact that you employ https://. If the Mossad wants your data, they’re going to use a drone to replace your cellphone with a piece of uranium that’s shaped like a cellphone, and when you die of tumors filled with tumors, they’re going to hold a press conference and say “It wasn’t us” as they wear t-shirts that say “IT WAS DEFINITELY US,” and then they’re going to buy all of your stuff at your estate sale so that they can directly look at the photos of your vacation instead of reading your insipid emails about them." -- James Mickens

      1 reply →

    • strictnein  1 hour ago

      > "it’s no big secret that the NSA is listening in on the node/isp level"

      The NSA is doing deep packet inspection at every "node/isp" in the world? That's a pretty amazing claim. How are they managing that?

      4 replies →

strictnein  1 hour ago

The NSA couldn't care less about you and your customers, nor do they have any interest whatsoever in the megaton of worthless internet traffic that goes through Cloudflare.

This article, from over a decade ago now, explains how they actually operate. Gobbling up all the traffic is a 20+ year old idea that never bore any fruit and is amazingly pointless. Instead, they might drop an implant in the SSD firmware of devices they actually care about, and they're not burning that to see if you sold X widgets to someone in Alberta.

https://blog.thinkst.com/2015/08/if-the-nsa-has-been-hacking...

  • celsoazevedo  1 hour ago

    There's a lot of important data that runs through Cloudflare, so I think it's a bit naive to think that there's nothing interesting for the NSA there.

    • ranger_danger  1 minute ago

      I'm more concerned about crimeflare's own incentive to analyze our traffic that people already willingly let them MITM, and somehow sell it to the highest bidder.

    • strictnein  29 minutes ago

      Of course, but the comment I was replying to stated:

      "the NSA learns everything there is to know about you and your customers"

      Which implies that they are looking at it all and records it.

      The vast, vast majority of Cloudflare's traffic is worthless to an intelligence agency.

  • jonathanstrange  32 minutes ago

    If I was the director of an agency of the size of the NSA and was evaluating the options purely from that perspective, I'd aim at creating a file on every living citizen on earth, including their social network topology and their activities. Basically a Google search engine that includes information not publicly accessible. I'd create much larger files for persons of interest and authorize targeted surveillance of them, of course, but with today's means to collect data a complete world database on every living and many dead persons is well within the technical capabilities. It also makes sense and is rational, if you put aside moral considerations.

    That's how I evaluate these things. If it makes sense and can be useful, it's likely going to be done. Notice that there is no law against this in the US if you exclude US citizens. It's perfectly legal and within their mission parameters to do it for non-US citizens. I used to think my judgments were a bit too much on the paranoid side but when Snowden published his leaks it turned out that I was roughly right about every capability the NSA had except for their internal security.

    • strictnein  20 minutes ago

      Yeah, I'm sure some system like that exists, although I'd assume that would be more in the CIA's purview. I'd be surprised if they kept a broad swath of data for most people though as the tech companies already do it and it's constantly up to date. If needed, a fed lawyer can work through the FISA court and the tech companies are obliged to provide the records.

ExoticPearTree  3 hours ago

> The hidden cost, of course, is that the NSA learns everything there is to know about you and your customers.

I doubt the NSA is gobbling up all the CF traffic because maybe, maybe they will find something of interest.

Can the NSA make CF "mirror" your website traffic to them if you are of interest to them, most likely yes.

I am not that paranoid to think that my website of a few corporate pages is of interest to the NSA.

  • petcat  3 hours ago

    The NSA collects and archives all internet traffic it can access for future analysis. It's the purpose of the Utah Data center.

    https://en.wikipedia.org/wiki/Utah_Data_Center

    • p-e-w  3 hours ago

      There’s no way a single datacenter costing a couple of billion dollars can store “all Internet traffic the NSA can access”, unless the traffic the NSA can access is a microscopic fraction of the total Internet traffic.

      Think about it. The Internet runs on tens of thousands of massive datacenters. Thousands are being built as we speak. Obviously a single datacenter cannot hold an appreciable fraction of that.

      BTW, the total budget of the NSA is less than the R&D budget of a FAANG company, so if you find yourself believing that they might have alien-level technology far beyond Google and AWS, you’re watching too much TV.

      8 replies →

  • bulbar  3 hours ago

    Not all traffic, but any.

    I agree it doesn't matter for most smaller entities, but it's relevant for larger entities and as the US does not anymore intend to be allied with Europe, the Western world, or anybody really, there's now actual incentive to move away from such systemic risks.

aranelsurion  4 hours ago

> The hidden cost, of course, is that the NSA learns everything there is to know about you and your customers.

I think it’s fair to assume that for most companies, cost is essentially zero on the company’s side.

milkshakes  1 hour ago

if your threat model includes the NSA i don't think your choice of CDN is going to make a difference

kakacik  5 hours ago

If you care about security and specifically NSA, don't use US clouds (owned or hosted), period. There is not a single one they don't have full access to, why should there be one.

Or clouds in general, its all wishful thinking and pinky promises.

mopsi  3 hours ago 

  > The hidden cost, of course, is that the NSA learns everything there is to know about you and your customers.

That depends heavily on the kind of site you're hosting there.

I have a small site on Cloudflare that lists a brief introduction of a sawmill, its operating hours and contacts, and a map that advises which roads to take to reach it. Everything's public already. There's some very modest value in tracking who visits the site, but with popular operating systems leaking like a sieve on the client side, that fight was lost a long time ago.