Are you concerned by TLS-terminating proxies like Cloudflare Tunnels?

Question

I believe many services rely on Cloudflare Tunnels or similar products that lets you proxy web requests from the public internet to your server without opening any port.This kind of proxy handles TLS (HTTPS), it's not possible to use Cloudflare Tunnels for raw TCP/UDP passthrough. This is convenient because it makes it more simple to use, but may be concerning because Cloudflare technically has access to all the plain-text traffic, even though seen from the end user the connection is HTTPS and looks perfectly normalThis is even more concerning to me given it's now public that most of internet traffic is automatically stored (see Wikipedia article "Room 641A for a good start)What are your opinions about this? Are this kind of proxy a no-go for any serious web service?

andy_pl · Accepted Answer

Same trust assumption as any reverse-proxied or CDN-fronted service. CF terminates TLS for Tunnels, Workers, the regular proxy, and Pages alike &mdash; if CF is in your threat model, the issue isn't Tunnels specifically, it's the entire CF surface you've accepted by being on their network. The honest framing isn't "no-go for serious services" but "what does your data residency / DPA / SCC posture look like."

zhouzhao · Answer

For European web services it should be a no-go.I understand the easiness of that approach, but companies should realize that relying on a giant American company for stuff like that, is going to bite them in the ass, eventually.