[adamgamble]

What am I missing? They literally decrypt all the traffic to your website, do some stuff, then re-encrypt and send it on to your server.

[james_in_the_uk]

Not an attack but certainly a person in the middle.

IAAL and advise on data protection and privacy.

Anecdotally I can tell you that the MitM aspect of Cloudflare and other similar providers is not well understood.

My impression is that a lot of people use these services without really understanding the implications.

For example, when you look at some of the risks that privacy laws are trying to protect against, especially access to data by foreign actors (including government agencies) without due process, use of these types of services changes the game.

Sometimes the benefits might outweigh the risks, but the decision to use these types of services should not be taken trivially.

That said, I routinely use Cloudflare for my personal projects.

[charcircuit]

And AWS has control of all of your servers and everything stored on them. If it's part of your systems architecture and how it's intended to work it isn't being attacked.

>They literally decrypt all the traffic to your website, do some stuff, then re-encrypt and send it on to your server.

That doesn't mean they are an attack. That is just how a CDN works.

[powersnail]

Does CloudFlare proxy your website without your permission?

[dns_snek]

You're being needlessly pedantic. It might not be an attack in the usual sense, but it's a MITM "access point" and agencies like CIA/NSA/FBI would definitely have that kind of access. This access transforms Cloudflare's role into a de facto MITM "attack" on their customers and end users who didn't intend to share unencrypted data with 3-letter agencies.

[cassianoleal]

It doesn't, but it does proxy my connections to several websites without my me having a chance to say no - in fact, without even telling me.