Yes, you’re right that there’s a certain amount of trust you need to have in CF… but what are you trusting it to do? And if they fail, what are the consequences?
Honest question - even if you are sending your Vaultwarden traffic over CF, and they are watching or attacking, you have to trust that the e2e encryption of Vaultwarden is what’s keeping you safe, right? Not the SSL certs. Does the auth mechanism rely on the SSL certs not to be compromised? I would hope not.
Yes, you’re right that there’s a certain amount of trust you need to have in CF… but what are you trusting it to do? And if they fail, what are the consequences?
Honest question - even if you are sending your Vaultwarden traffic over CF, and they are watching or attacking, you have to trust that the e2e encryption of Vaultwarden is what’s keeping you safe, right? Not the SSL certs. Does the auth mechanism rely on the SSL certs not to be compromised? I would hope not.
For me, it’s about trade offs.
https://www.troyhunt.com/cloudflare-ssl-and-unhealthy-security-absolutism/
https://serverfault.com/questions/662946/does-cloudflare-know-the-decrypted-content-when-using-a-https-connection
These two data sources kinda sum it up for me - “If you are concerned that cloudflare can read your data - don't use cloudflare.”
But I do want to be sure that any e2e encrypted app doesn’t rely on SSL for its “end-to-end”.