• TheAnonymouseJoker@lemmy.ml
    04·
    3 years ago

    Someone’s comment who I know:

    CEO of CloudFlare once said:

    Matthew: Back in 2003, Lee Holloway and I started Project Honey Pot as an open-source project to track online fraud and abuse. The Project allowed anyone with a website to install a piece of code and track hackers and spammers.

    We ran it as a hobby and didn’t think much about it until, in 2008, the Department of Homeland Security called and said, “Do you have any idea how valuable the data you have is?” That started us thinking about how we could effectively deploy the data from Project Honey Pot, as well as other sources, in order to protect websites online. That turned into the initial impetus for CloudFlare.

    (Source)

    BBC reporter Zoe Kleinman wrote that Matthew Prince wanted $20,000 for the Honey Pot data. “That check showed up so fast,” said Prince. Michelle Zatlyn heard the story from Prince and replied, “If they’ll pay for it, other people will pay for it.” Soon she and Prince cofounded CloudFlare.

    From an article:

    Swearing off data collection

    But wait, if Cloudflare is directing your website queries, then can’t it collect your browsing history for itself? Actually, they’re not going to keep that data at all, Prince said.

    “At no time will we record the list of where everyone is going online,” Prince said. “That’s creepy.”

    Cloudflare is working with third-party auditors at KPMG to examine their systems and guarantee they’re not actually collecting your data. That privacy commitment, Prince said, is what separates Cloudflare’s 1.1.1.1 from other DNS services that are free and open to the public.

    […]

    Cloudflare’s promise to keep your data private is impressive, said Heidi Shey, a privacy and security expert at business analyst firm Forrester. “It’s a great thing that they’re coming out of the gate and being up front about that,” Shey said. Still, she added, “You’re kind of taking what they’re saying at face value.”

    The company will need to continue to be transparent, showing what the auditors find in their logs, for consumers to continue to trust the service, Shey said.

    (Source)

    Concerning KPMG, “the well-respected auditing firm” as Cloudlfare puts it. Really?

    Hmm… so much for “put our money where our mouth was” (source), interesting choice Cloudflare!

    The gist of this is: DHS saying there is valuable data of those collections, hence the initial impetus for CloudFlare after having $20,000 from their Project Honey Pot! My question would rather be, who’s operating those DNS providers and who’s watching the watchers? Because, DNS queries can reveal a lot about a persons internet activity and usage. There is an interesting research about DNS on the topic of user privacy, though the research is about Tor and DNS (and thankfully Tor is still safe as they said that they “don’t believe that there is any immediate cause for concern.”), the researchers said:

    We show how an attacker can use DNS requests to mount highly precise website fingerprinting attacks: Mapping DNS traffic to websites is highly accurate even with simple techniques, and correlating the observed websites with a website fingerprinting attack greatly improves the precision when monitoring relatively unpopular websites.

    So, just like the internet is plagued with Google Analytics and other of their subsidiaries. We are then now plagued more by CloudFlare with their CDN and DNS.

    Relevant:

    Concerning DNS over HTTPS (DoH), internetsociety.org noted:

    [RFC8484] specifies how to send and receive DNS queries over HTTPS. Server configuration is performed out of band, and the connection with the resolver is secured as any other HTTPS traffic. DoH is mostly targeted at web browsers and does not have the potential for improving the privacy properties of transactions between recursive resolvers and authoritative nameservers.

    What people should understand as noted by internetsociety.org’s document concerning encrypted DNS is: the mechanisms should be seen as ways to improve, in specific scenarios, certain aspects of network privacy, but not as replacements for other privacy mechanisms such as VPNs or other implementations such as Tor.