Ask HN: Are you concerned by TLS-terminating proxies like Cloudflare Tunnels?

21 pointsthom-gtdp13d ago6 comments

I believe many services rely on Cloudflare Tunnels or similar products that lets you proxy web requests from the public internet to your server without opening any port.

This kind of proxy handles TLS (HTTPS), it's not possible to use Cloudflare Tunnels for raw TCP/UDP passthrough. This is convenient because it makes it more simple to use, but may be concerning because Cloudflare technically has access to all the plain-text traffic, even though seen from the end user the connection is HTTPS and looks perfectly normal

This is even more concerning to me given it's now public that most of internet traffic is automatically stored (see Wikipedia article "Room 641A for a good start)

What are your opinions about this? Are this kind of proxy a no-go for any serious web service?

6 comments

zhouzhao13d ago

For European web services it should be a no-go.

I understand the easiness of that approach, but companies should realize that relying on a giant American company for stuff like that, is going to bite them in the ass, eventually.

sdevonoes12d ago

Wtf. This post has 3 accounts opened in less than 48h ago which are talking to each other with AI flavours. I suspect they all are managed by the same person.

It should be trivial flag such behaviour

thom-gtdpOP12d ago

My account is new but I'm a real person and this is my only account. Didn't use AI to write this post

andy_pl13d ago

Same trust assumption as any reverse-proxied or CDN-fronted service. CF terminates TLS for Tunnels, Workers, the regular proxy, and Pages alike — if CF is in your threat model, the issue isn't Tunnels specifically, it's the entire CF surface you've accepted by being on their network. The honest framing isn't "no-go for serious services" but "what does your data residency / DPA / SCC posture look like."

thom-gtdpOP13d ago

Yup Workers has similar risks as Tunnels. Cloudflare Pages isn't the same threat as Tunnels, as Pages only gives CF public data access. On Pages you trust Cloudflare for not altering the data served, while on Tunnels you trust CF for handling secret data. I actually don't really have a data residency / DPA / SCC policy because I was considering using Tunnels for my homelab only

andy_pl13d ago

Right, the Pages vs Tunnels split is real — different threat surfaces. For a homelab the GDPR/SCC scaffolding doesn't apply; the practical question becomes "do I trust CF more than my own ISP for opportunistic snooping," and on that axis CF's incentive structure is reasonably well-aligned.

j / k navigate · click thread line to collapse

6 comments

zhouzhao13d ago

For European web services it should be a no-go.

I understand the easiness of that approach, but companies should realize that relying on a giant American company for stuff like that, is going to bite them in the ass, eventually.

sdevonoes12d ago

Wtf. This post has 3 accounts opened in less than 48h ago which are talking to each other with AI flavours. I suspect they all are managed by the same person.

It should be trivial flag such behaviour

thom-gtdpOP12d ago

My account is new but I'm a real person and this is my only account. Didn't use AI to write this post

andy_pl13d ago

thom-gtdpOP13d ago

andy_pl13d ago

j / k navigate · click thread line to collapse