The CDN's are the MitM.
this post was submitted on 08 Oct 2026
63 points (98.5% liked)
Privacy
51556 readers
552 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 7 years ago
MODERATORS
What exactly are the CDNs?
The Man in the Middle (MitM).
I.e. if they're terminating TLS and then forwarding to your TLS servers then they are capable of inspecting all the traffic to and from your service.
This is exactly what a MitM attack in is.
What if we just blocked all the cdns? I think I've locked a few out of my domain.
This sounds like it defeats the purpose of a private DNS. At least there is VPN.
A VPN isn't going to protect you from CloudFlare being compromised and you'll never even know.
Likewise a private DNS will still be resolving to the CF addresses.
why wouldn't that be the purpose of cloudflare? the system is designed to do what it eventually does. Not what we are told, hope, or dream.
cloudflare in its service, provides a clean, efficient way, to centralize, a decentralized independent internet. Giving whoever holds the keys to cloudflare control over those resources, for whatever purpose. Ban's ? Instant. Shadow ban, easy. Hoax (redirecting traffic) simple. The idea that 'but they're not supposed to' is childish.
Never give people power over you. Ever.
Yes this is absolutely a risk..
imo that is precisely how it has grown so large and so quickly
Let’s be clear that not just any state actor can do this. We’re talking about the US, UK, rest of the eyes alliance. Snowden revealed they are the threat who operates like this and we shouldn’t forget it.
India can’t likely do this, China, Russia, Brazil, South Africa cannot do it.
I missed why China, Russia, et al cannot do it. What do you mean?
You are entirely correct. What Cloudflare does is also valuable and tricky to replicate though, so people reeeally want to deny it
Everyone has different values
Cloudflare also forces you to enable javascript, so allowing them to fingerprint and de-anonymize you
i was aware of this, but didn't think much of it because everyone's doing this, but i switched to jshelter a week ago and 👏 every 👏 single 👏 site 👏 forces me to disable it to use it besides -- even the catgirl protecting lemmy.
Been saying this for years. Check my comment history.
Tailored Access Operations (TAO) would be the NSA team in charge of it.
Or certificate providers are ordered to provide a false certificate; or in case of Europe (thanks to the GDPR), the "data protection officer" that larger services operating in the Union (including cloud- and hosting-services: hosting most of the modern internet), are forced to employ and provide with unrestricted access (supposedly "to monitor compliance"), may be ordered to do additional processing (including that for which their "employer" has no legal basis), whilst being gagged by "professional secrecy" (including towards this "employer"); and the NSA also has a program that seeks to weaken TLS standards (at least by pushing standards for post-quantum encryption (PQE) only, instead of AES + PQE).