#Stackexchange just became a Cloudflare site, which means it’s now an exclusive resource and also everyone’s data including usernames & passwords are exposed to Cloudflare.

This is antithetical to the pro-privacy philosophies of the #Monero community. Please consider removing it from the sidebar or caution people about CF. Thanks.

  • dohpaz42@lemmy.worldEnglish
    5·
    1 year ago

    I’m curious about the username/password exposure claim. Do you have resources about that you can share?

    • soloActivist@links.hackliberty.orgOP
      41·
      1 year ago

      This page covers a lot of Cloudflare issues:

      https://git.kescher.at/dCF/deCloudflare/src/branch/master/subfiles/rapsheet.cloudflare.md

      The 2nd link on that page goes to:

      http://cryto.net/~joepie91/blog/2016/07/14/cloudflare-we-have-a-problem/

      which details the traffic exposure to #Cloudflare as a consequence of Cloudflare holding the keys & terminating the tunnel (thus performing the decryption). Indeed the padlock is misleading as most users believe the tunnel goes all the way to the source website.

      edit: BTW, I see that you are on #lemmyWorld. You might be interested in knowing that that’s also a Cloudflare site. Cloudflare sees your login credentials, your IP address, and everything you do with your lemmy account. As far as gatekeeping goes, Lemmy World has been manually configured to be less exclusive than default-configured sites like stackexchange. E.g. I am blocked from stackexchange but not from lemmy world.

      • nutbutter
        1·
        1 year ago

        What about buying domins from them and using them to manage DNS records? I do turn off the proxy feature so, I know they can’t sniff any data, and my visitors are not connected to Cloudflare. Is this okay, or should I transfer my domains?

        • soloActivist@links.hackliberty.orgOP
          2·
          1 year ago

          Some sites use CF DNS just to have the ability to spontaneously switch on the proxy at will. They tend to keep the proxy turned off but then when traffic peaks a bandwidth detection mechanism switches on CF proxying. The problem with that is users don’t know from one click to the next whether their traffic will be intercepted. It can happen at any moment. So the deCloudflare project treats CF DNS cases no different than always-proxying sites.

          So if you have no intention of using CF’s proxy, using a non-CF service would make more sense so your domains don’t get treated as CF. CF is not a good company to support anyway.

          • nutbutter
            1·
            1 year ago

            Thanks for the detailed reply. If I may ask for your opinion, which domain seller should I switch to?

            • soloActivist@links.hackliberty.orgOP
              2·
              1 year ago

              i’m not the best person to ask since I’m not maintaining and domains myself right now. I thought porkbun.com looked like a good choice at one point. They announced that they were going to move to cloudflare (just for the management portal), which was quite off-putting nonetheless, but it looks like they did not follow through with that.

              EDIT-- I recently heard they are using CF for DNS and some people are avoiding #Porkbun for that reason.