Security issue (Cloudflare is set up as a TLS terminating proxy)

How to verify:

1) visit https://discordapp.com/channels/@me

2) inspect the TLS certificate

3) notice that the certificate has Common Name ssl711320.cloudflaressl.com

There's only 1 possible cause of this: Cloudflare is configured to act like TLS terminating proxy. Which means Cloudflare sees (all?) traffic between user and Discord.

A lot of other sites use Cloudflare in the same way, which may result in huge privacy issues if they mistreat the data they have. (profile of users across lots of sites - unfortunately, Discord is one of them)

More info:

https://www.reddit.com/r/privacy/comments/41cb4k/be_careful_with_cloudflare/

https://security.stackexchange.com/questions/175740/how-can-cloudflare-read-encrypted-request-without-private-key

Commentaires