You provide a DTLS to clear-text proxy service, for applications where the client supports DTLS, but the server does not (or vice versa)?
Yeah, why did you build this? It's unclear what the value proposition is, paying for a MitM proxy. It effectively means it cannot be used with secrets, without trusting y'all to not be snooping?
Your summary is about right, but the use case is simply not wanting to run always-on servers around the world (we have anycast IPs backed by handlers around the world). So it's convenience and scale first, and wanting to build with event-driven architectures second.
Yes, your point on security is correct. Since our service terminates the DTLS connection we could see the cleartext (just as any gateway service does, like AWS API Gateway, etc.). We don't touch it except as strictly needed to pass it to the configured integrations.
EDIT: FWIW, using a plain UDP handler you could implement DTLS handling that runs in your control, in which case payloads would be opaque to us. That's a bit of an effort, though. We were asked for this, so we built it.
"Clients establish a DTLS 1.2 or DTLS 1.3 session with the Listener's assigned domain and port."
"Every DTLS Listener receives a server certificate and private key managed by Proxylity."
I don't get it. Why would anyone want to send all their private information unencrypted to your serverless server?
"Get fired from your Organization for sending company or private data unencrypted to some random guys on the Internet" as a Service? Based on lossy UDP?
Most traffic on the Internet flows unencrypted through a portion of some reverse proxy MITM-as-a-service provider's gear like Cloudflare, Cloudfront, Akamai etc.
You can't proxy TLS for people without having the ability to see the decrypted data somewhere inside the server software/RAM. They (or a government) may or may not be looking at it or storing it, but the possibility is there.
Why would an origin be unable to speak TLS? An ESP can speak TLS. A RP2040 can speak TLS. My watch can speak TLS. TLS even is implemented on the Commodore 64 by now.
For the features you mention: Yes, you need meta-data for this. But you don't need to see the payload, a picture of my naked 4 year old kid.
I didn't mean it so much as a physical constraint, but an operational one.
Not everyone wants to (or their policy allows them to) manage TLS certs directly on their origin servers, and some services only allow plaintext HTTP origins, like AWS ALB/ELB. In that particular case it's "ok" because the load balancer is placed inside your VPC, so cleartext traffic is not visible to other customers or networks.
You can. What you do is take the Client Hello packet, and inspect the public SNI field. This will show you the destination to proxy to. Your forward to that server, and that server then completes the handshake.
No matter if you are using TLS over TCP (or HTTPS) or DTLS - end-to-end-encryption can be kept up simply by proxying on the first step of the Handshake.
I should have clarified... when I said "proxy TLS" I meant while retaining the typical features that reverse proxy providers offer like those I mentioned here: https://news.ycombinator.com/item?id=49662319
If for example Cloudflare decided to offer this SNI-based TLS passthrough, they could no longer give you adequate DDoS protection, caching, analytics etc.
I disagree. What you do (well, and what I do in my code) is this: You cache the original IP packets containing the Client Hello. You inspect those packets. And you make your DDoS protection etc based on this. And if you decide the packet is OK forwarding, only then you replay the original IP packets to the destination.
I know that you can not inspect content this way. But there simply are situations where content SHOULD NOT be inspected.
I certainly would not call that adequate, especially for someone like Cloudflare with their scale, and with what their customers expect.
What you describe may be technically possible in a very narrow sense, for only specific types of DDoS attacks, but I don't see it being practical in most cases, plus I think ECH would make this difficult to do properly.
We had CDNs for ages. They are fine for static content. But no, you should not proxy any confidential or personal data unencrypted through a third party, that is crazy. That stuff must be end-to-end encrypted between you and your peer.
I think the marketing terms here are blurring the vision of developers. You need to understand what you are doing. "Can this data be handed over to a man in the middle?" must be something you actively think about, then making a decision.
Like. It’s already over the internet. If I have to send it unencrypted to you, why not just send it unencrypted to the destination? The cat’s already out of the bagel, so to speak.
19 comments
[ 2.7 ms ] story [ 16.2 ms ] threadYeah, why did you build this? It's unclear what the value proposition is, paying for a MitM proxy. It effectively means it cannot be used with secrets, without trusting y'all to not be snooping?
Yes, your point on security is correct. Since our service terminates the DTLS connection we could see the cleartext (just as any gateway service does, like AWS API Gateway, etc.). We don't touch it except as strictly needed to pass it to the configured integrations.
EDIT: FWIW, using a plain UDP handler you could implement DTLS handling that runs in your control, in which case payloads would be opaque to us. That's a bit of an effort, though. We were asked for this, so we built it.
Is that not exactly cloudflare?
"Every DTLS Listener receives a server certificate and private key managed by Proxylity."
I don't get it. Why would anyone want to send all their private information unencrypted to your serverless server?
"Get fired from your Organization for sending company or private data unencrypted to some random guys on the Internet" as a Service? Based on lossy UDP?
...What? Why would anyone do that?
I don't get it.
You can't proxy TLS for people without having the ability to see the decrypted data somewhere inside the server software/RAM. They (or a government) may or may not be looking at it or storing it, but the possibility is there.
If you assume the origin can speak TLS and holds the cert/private key, then I suppose in a limited way it's possible. But...
> because they want to intercept all your traffic so the NSA gets a copy.
I don't believe that is the reason. I believe it's for features.
You need actual TLS termination to do most things CDNs and reverse proxies offer, such as:
- caching and compression
- WAF / bot detection
- URL-based routing
- header manipulation and redirects
- application-layer DDoS filtering
- analytics
- edge functions and content transformation
For the features you mention: Yes, you need meta-data for this. But you don't need to see the payload, a picture of my naked 4 year old kid.
Not everyone wants to (or their policy allows them to) manage TLS certs directly on their origin servers, and some services only allow plaintext HTTP origins, like AWS ALB/ELB. In that particular case it's "ok" because the load balancer is placed inside your VPC, so cleartext traffic is not visible to other customers or networks.
No matter if you are using TLS over TCP (or HTTPS) or DTLS - end-to-end-encryption can be kept up simply by proxying on the first step of the Handshake.
That is the correct way how to do it.
If for example Cloudflare decided to offer this SNI-based TLS passthrough, they could no longer give you adequate DDoS protection, caching, analytics etc.
I know that you can not inspect content this way. But there simply are situations where content SHOULD NOT be inspected.
What you describe may be technically possible in a very narrow sense, for only specific types of DDoS attacks, but I don't see it being practical in most cases, plus I think ECH would make this difficult to do properly.
We had CDNs for ages. They are fine for static content. But no, you should not proxy any confidential or personal data unencrypted through a third party, that is crazy. That stuff must be end-to-end encrypted between you and your peer.
I think the marketing terms here are blurring the vision of developers. You need to understand what you are doing. "Can this data be handed over to a man in the middle?" must be something you actively think about, then making a decision.