Maybe you didn’t quite understand me. I meant that the problem with ssl certificates is even more interesting than it seems.
For example, if I register for cloudflare and pay a $10 tariff, my certificate will be visible to everyone as an outsider. And if I pay $200, I can download any certificate, but the private key is still on cloudflare. And I can order private DNS. How carefully you examine the site before visiting it.
Cloudflare is a private company. I know they are offering tons of bells and whistles, and they keep adding to their portfolio on a regular basis. To much to keep up for me anyways.
But the features you seem to be reffering to is their feature to upload your own certs and keys, and the feature for keyless ssl?
I never used these features, but i looked them up for a discussion i had a long time ago, so i'm aware of their technicality's. If i remember correctly (i didn't re-read the whitepaper, this stuff comes from memory) the first feature gives cloudflare all the tools to generate symmetric keys themselves, the other just gives them only the symmetric keys (and you host some kind of service on your host to let them request a new symmetric key).
These service *might* look "better" to the untrained eye, but in fact they are worse: when you use them you're even hiding the fact that cloudflare acts as a MITM (but they still are!!!). When you use these services, your customers will never know cloudflare can (and will!!!) decrypt every package they exchange.
The bottom line is very, very simple and does not differ from which package you buy or which technology they implement: their proxy REQUIRES them to decrypt the traffic between (what the visitor thinks is) the visitor and the webhost.
Why? Well, you know those nice features they offer: DDos protection and their CDN? Both these things are built on the fact that they keep a big cache of DECRYPTED data from YOUR host on their datacenters. When a client requests a page, they HAVE to be able to see what the client requested (so they HAVE to decrypt the request), then they can see if they have the requested data somewhere on their servers (UNENCRYPTED). When they don't have the data in their cache, they WANT the data in their cache, so they request it from the host, DECRYPT it, and PUT it in their cache before (or after) re-encrypting it and sending it to your client.
That's why they're able to offer DDos protection: your data is on so many geo-located servers, and they're so big, an attacker just can't muster up a botnet that's so big he/she can tear down cloudflare. They'r still DDos'ing, cloudflare does not stop them, cloudflare just absorbs the requests... Maybe they block them after a while, IDK, but in the first place they just absorb them due to the fact they have your data anyways, and they have dozens of copy's of your data all around the world, so let a botnet request a couple million of copy's: they don't care.
That's why they can speed up your site: they have copy's of most of your content all over the world on fast servers: a client downloads most of your content directly from cloudflare (and not from you), from a fast server close-by.
And in the end it doesn't matter if you use cloudflare's SSL, you upload your cert+key or you run "keyless ssl" by running a local deamon to generate symmetric keys.... If you use the proxy, they have your data.... Which is bad for a mixer.
And the thing is (and i've said this before): i wouldn't even mind all that much if the mixer operators had any clue as to what they were doing and warned their clients... Like @LeGaulois already said: some people won't care if law enforcement knows who they are, they just want $5 wrench protection.
But the very least a mixer operator should do is plaster a big warning on their clearnet site about the fact that the clearnet version is cached by cloudflare and both cloudflare employees and law enforcement. At least this would demonstrate the fact the mixer operator knows enough about this techology to run a mixer.
But by acting like most mixer operators do when i point out they use cloudflare (shrugging, telling me other do the same thing), i get scared.... Very scared.... How can you trust the algorithm, the code, the workflow of a mixer operator who doesn't understand the slightest thing about why a MITM is bad for a mixer? When i see the reactions from mixer operators, i always wonder what their code would look like.... Or maybe they're running their operation from shared hosting? Or maybe.... Well horror scenario's pop to mind....
