I need a browser extension (for Safari) to warn me if the site is behind Cloudflare. I'll pay money :) I'm kinda protected by using VPN, IP is not my ISP IP. But the rest, plus browser fingerprinting is busted.
Use this: www.cloudflare.com/ips/ and HTTP headers like CF-RAY
same as with any other CDN, the load-balancer frontend of any cloud provider (e.g. if HIBP weren't behind Cloudflare, would you post the same about Azure, where its backend lives?), ...
I get why people are critical of SSL termination that talks to the backend over public channels unencrypted (which Cloudflare offers too), but for the HTTPS-to-HTTPS case they behave exactly like many other companies.
That I find it weird that people appear to single out Cloudflare (e.g. asking for a Cloudflare-detection extension) when there's nothing materially different about them from many other companies serving large parts of the web. Traffic is protected between you and an agent the site you are visiting trusts, just like in nearly every other hosting scenario. You're almost by definition not "pwned" if your traffic is seen by someone who is supposed to see it, as long as they treat it appropriately.
> You're almost by definition not "pwned" if your traffic is seen by someone who is supposed to see it,
Well ... Noone, repeat, Noone is supposed to see my traffic except the site owner. I just don't buy the 'trusted' CDN provider idea. 'treat it appropriately' - I'm past that.
Do you buy the idea of trusted hosting providers? Or does everyone need to own their hardware? Or are rented VMs ok? (where traffic isn't exposed by design, unlike with traditional hosting or ingress services by cloud providers, but could be accessed by the provider if it really wanted to)
> Nothing is wrong about CNN terminating SSL on CNN CDN nodes, it is part of CNN's infrastructure. In house.
But they don't, they use Fastly, at least that's where cnn.com points. Are they better than CF?
I did know that HN uses Cloudflare, yes, and if I distrusted Cloudflare specifically I'd maybe want something making sure I always know, but I kind of expect nowadays that sites use CDNs or cloud infrastructure and have no strong reason to distrust any of the many providers more than the others.
You are. HN sits behind Cloudflare. Your SSL connection terminates at Cloudflare to plaintext, and new SSL connection to HN is created.
Your login and password, IP and User-Agent and who knows what else, is in clear view to Cloudflare - you've been pwned :))