Regardless of whether or not you provide your own SSL certificates, cloudflare still uses their own between their servers and client browsers. So any SSL encrypted traffic is unencrypted at their end before being re-encrypted with your certificate. How can such an entity be trusted?
Isn’t this also what many companies do to monitor web-traffic from their network?
Speaking from experience, companies that are trying to do this will typcially do it one of two ways: either through DNS lookups by having their on-network DNS server acting as a recursive server, thus being able to intercept/interpret DNS requests and apply filtering rules, OR through a forward proxy that all web traffic exiting the company network will go through. Forward proxies can absolutely be configured for SSL interception, and it’s typically handled by using a company-issued certificate signed by the company’s CA…and every company computer has the company’s CA certificate installed, so it’s explicitly trusted. This is why you shouldn’t do any kind of personal business (especially banking) on company-owned devices.
The biggest difference between companies using a forward proxy and an attacker using DNS poisoning to redirect the traffic is intent - the attacker is doing it for explicitly malicious purposes, while the company is ostensibly doing it to enforce company policy (especially AUPs)…having access to all the delicious unencrypted data is simply a side effect. You trust your employer, don’t you friend citizen?
You damn well do iff you wanna pay that mortgage, peasant! 🤑
This is exactly the original point I was trying to make regarding cloudflare.
The point that i take from this tongue-in-cheek sentence of yours is that no, we should absolutely not trust our employer with our unencrypted traffic.
But then on the other hand there are loads of people on here saying that, yes, of course we should trust cloudflare with having access to all of the data flowing through it.