knowing when to trust a login page on a Cloudflare site

Submitted ⁨⁨1⁩ ⁨month⁩ ago⁩ by ⁨coffeeClean@infosec.pub⁩ to ⁨cybersecurity@infosec.pub⁩

Question for people willing to visit Cloudflare sites:

How do you determine whether to trust a login page on a CF site? A sloppy or naïve admin would simply take the basic steps to putting their site on Cloudflare, in which case the authentication traffic traverses CF. Diligent admins setup a separate non-CF host.

Doing a view-source on the login page and inspecting the code seems like a lot of effort. The source for the lemmy.world login page is not humanly readable. It looks as if they obfuscated the URLs to make them less readable. Is there are reasonably convenient way to check where the creds go? Do you supply bogus login info and then check the httpput headers?

source

Comments

Sort:hotnew top

Dave@lemmy.nz ⁨1⁩ ⁨month⁩ ago
I think you can assume that your credentials go via Cloudflare.

But the only thing you can do on lemmy is post stuff publicly, and presumably you are using randomised passwords, so what’s the cyber security risk?

source
- coffeeClean@infosec.pub ⁨1⁩ ⁨month⁩ ago
  
  I think you can assume that your credentials go via Cloudflare.
  
  That would be my natural assumption until the contrary is verified.
  
  But the only thing you can do on lemmy is post stuff publicly, and presumably you are using randomised passwords, so what’s the cyber security risk?
  
  I would not register on a CF site for anything AFAICT, and most certainly not a Lemmy site amid non-CF Lemmy sites. Lemmy.world is just a good example for my question because the code is obfuscated. My problem is often that I register on a non-CF service then it becomes CF and it’s not always social media. Indeed I use unique unguessable passwords for each site. But that’s not what the masses do. I’m trying to work out what diligent users do. I’m not sure how many people will evade my question. So I’ll try an example to overcome that. Suppose my bank becomes Cloudflared, without announcement (thus no time to pull my money out before it happens), and they charge a high fee for paper statements? The customer may choose good unique passwords, but this does not mean that password does not need to be protected. Most banks’ terms of service make customers liable for sharing creds with a 3rd party, and the ToS also includes a disclaimer for that bank. So if creds are compromised via CF the ToS is written to make the customer liable.
  
  That’s just an example. Examples aside, I’m asking how a diligent user checks whether their creds are shared with CF.
  
  source
  - glowie@h4x0r.host ⁨1⁩ ⁨month⁩ ago
    Yes, CF can view your login creds as the reverse-proxy effectively acts as a MitM handling the encryption and decryption.
    
    source
    -> View More Comments
slazer2au@lemmy.world ⁨1⁩ ⁨month⁩ ago
You don’t. Assume the password is hashed server side and are sent unhashed via the TLS session that CF mitm.

source
- coffeeClean@infosec.pub ⁨1⁩ ⁨month⁩ ago
  What if I am reporting a GDPR offender who (e.g.) neglected my article 15 request? If I make the assumption you are suggesting and write in my Article 77 complaint that the data controller needlessly exposes passwords to Cloudflare, and it turns out to be untrue, then my report loses credibility.
  
  source
  - slazer2au@lemmy.world ⁨1⁩ ⁨month⁩ ago
    You seem to make the assumption that CF is storing that level of your data. In all likelihood CF are inspecting the traffic for malicious intent and if there is nothing malicious the non metadata is dropped.
    
    source
    -> View More Comments