Why does Trocador use Cloudflare MITM? (sh.itjust.works)

submitted 5 months ago by Scolding0513@sh.itjust.works to c/monero@monero.town

19 comments fedilink hide all child comments

I made a post here about the danger of Cloudflare and the nightmare about how it functions:

https://sh.itjust.works/post/20529148

Cloudflare is a MITM can see everything going on and every request I'm making plus all the data I'm sending.

So explain to me why Trocador is using it? Are they a honeypot? They pride themself soooo much on anonymity, NoJS, Onion support, deletion of records, No KYC, No logs unless fully necessary, but yet, they allow Cloudflare to record every single piece of data about my interactions on trocador, all the requests, both POST and GET, all the addresses and amounts im inputting, quotes im making, and of course, associate my browser fingerprint and IP with all that yummy data that the NSA would be really happy to collect ;) ! How curious indeed..

It's a known fact that Cloudflare works the way I described. So why would Trocador willingly give over everything I'm inputting into the site over to Cloudflare? Please, someone explain this to me.

And it's not just trocador. soooo many Monero and privacy oriented sites are using Cloudflare MITM. Today I'm picking on Trocador but later I'll pick on more as I remember/come across them.

Here is a relevant paragraph I wrote:

I'm sick to my stomach of all these orgs and companies and people talking about privacy, and then they constantly do all these kinds of things thst prove that they don't actually care about privacy or anonymity or anything in between. They are Vipers and Snakes trying to make a quick dollar on a buzzword. It's become sadly trite.

I'm fully ready to somehow(?) be wrong about all this and eat my words.

you are viewing a single comment's thread
view the rest of the comments

[-] TrocadorApp@monero.town 16 points 5 months ago* (last edited 5 months ago)

Hey there, Trocador.app team here.

First of all, we fully get OP's concern about Cloudflare, and it would be very hard for us to argue against the gist of their argument. There's a good reason we don't have Cloudflare as part of our standard operations. However, that means we must implement our own defences against such attacks. We are fine with that. After all, that's enough most of the time. As anyone running a web service in our community knows, we've all been increasingly targeted with DDoS attacks. Here at Trocador, we've had our fair share of them over the last few months, and we've been managing well in our estimate, given our team size. However, last week's incident was something different. We were faced with the option of keeping the service down, or temporarily switching to Cloudflare in an attempt to keep the services running while we hardened our infrastructure. The switch was successful in mitigating the attack's effects, and we kept the platform up. We are aware this is far from ideal to a significant share of our users. That is why we did our best to keep our Tor service operational throughout the attack. Ideally we would have implemented a message on our main page so our users are aware, but most of our team has been busy with Monerokon the past few days. Perhaps that's why the attack was initiated in the lead-up to the event. But who knows... lesson learned!

Our aim is to switch back to normal operation as soon as the attack is over. Unfortunately this attack seems to be much more targeted than previous ones, and has been going on for many days already.

The Monero community has been great as always, and some very competent individuals have reached out to offer guidance and assistance. We're currently working on improving our defences, and we'll be off Cloudflare again very soon, probably in the next couple of days if our strategy works. We were expecting to leave CF today, which would have been only 6 days total using them, but this also depends on our team managing to solve all issues before that, and again, most of our staff is on Monerokon.

[-] Scolding0513@sh.itjust.works 8 points 5 months ago

Thank you for responding, the communication is much appreciated. Seems like poor timing with the attack and monerokon happening at once, for sure.

Yes, agreed, as said in another comment, it would be really great if such things could be communicated to the community. I recommend a banner on the site with the latest update and a link to a mastadon page or a third party blog page (so people can bookmark it in the case of a teml shutdown). All of the words you gave here should be in such a post. otherwise people see the infamous CF MITM page and have to assume the worst :(

Thanks again for the response, I really hope the team is able to get some long term non-Cloudflare mitigations very soon.

[-] TrocadorApp@monero.town 5 points 5 months ago

Thanks for the kind words. Tomorrow our team will be 100% focused on these tasks! By the way, Monerokon was great! A lot of good people there, an outstanding community!