Karthik Balakrishnan is a developer in India who wrote about Airtel intercepting and censoring traffic that passes through Cloudflare.
HN cites his post when discussing Cloudflare's flexible SSL option, which lets ISPs like Airtel inject ads and block sites on traffic to origin servers.
> "untargeted national snooping"
While I do not disagree with your sentiment, there have been cases of untargeted national snooping/censorship affecting sites with flexible SSL because governments can and often do sit between the local Cloudflare server and the origin.
https://medium.com/@karthikb351/airtel-is-sniffing-and-censoring-cloudflares-traffic-in-india-and-they-don-t-even-know-it-90935f7f6d98
I've also been hoping that Cloudflare would add a header indicating the backend encryption status, so that we can look at how sites are configured and whether any "important" sites are using flexible SSL:
https://github.com/cloudflare/claire/issues/17
The problem with in-the-browser encryption is that it is fundamentally insecure until websites can be made immutable. You're executing remote, mutable code to handle your secret data. Which means at any point the website operator could replace it with something that exfiltrates the data the moment you access it.
Even if the operator is not malicious they could receive a court order or the connection loading the code could be MITMed even if you think you're secure[0].
[0] https://medium.com/@karthikb351/airtel-is-sniffing-and-censoring-cloudflares-traffic-in-india-and-they-don-t-even-know-it-90935f7f6d98#.jktc9i7r6
Particular to India, Cloudflare edge data-centres use Airtel network — which is notorious for using MITM for arbitrary bans. If cloudflare fetches your site without SSL then Airtel can and does block it and even inject ads; this is regardless if you use cloudflare's https to serve content to your clients. More info here [1], and hn discussion here [2].
[1] https://medium.com/@karthikb351/airtel-is-sniffing-and-censoring-cloudflares-traffic-in-india-and-they-don-t-even-know-it-90935f7f6d98
[2] https://news.ycombinator.com/item?id=12091900
It would be possible for an ISP to MITM the traffic between Cloudflare and the origin server since it can be configured to be done via unencrypted HTTP or non-trusted certs on HTTPS (flexible SSL). See https://medium.com/@karthikb351/airtel-is-sniffing-and-censoring-cloudflares-traffic-in-india-and-they-don-t-even-know-it-90935f7f6d98 for an example of Cloudflare serving a MITM notice page for pirate bay.
That flexible ssl option is a huge problem. Some years back, https:// secured sited started showing injected ads and messages from an Indian ISP providing service to cloudflare there: https://medium.com/@karthikb351/airtel-is-sniffing-and-censoring-cloudflares-traffic-in-india-and-they-don-t-even-know-it-90935f7f6d98
Enabling HTTPS on the CDN is good for the users, but please consider using it between the CDN and your network as well - if nothing else, it prevents situations like this: https://medium.com/@karthikb351/airtel-is-sniffing-and-censoring-cloudflares-traffic-in-india-and-they-don-t-even-know-it-90935f7f6d98