Serverless DTLS(proxylity.com) |
Serverless DTLS(proxylity.com) |
"Every DTLS Listener receives a server certificate and private key managed by Proxylity."
I don't get it. Why would anyone want to send all their private information unencrypted to your serverless server?
"Get fired from your Organization for sending company or private data unencrypted to some random guys on the Internet" as a Service? Based on lossy UDP?
...What? Why would anyone do that?
I don't get it.
> ...lossy UDP
All networks are lossy, and all transports. The difference between UDP and TCP based transports is who decides how to handle it. With UDP the application developer decides; with TCP (and QUIC) the protocol decides. More and more projects are taking-on the reliability decision, for a lot of reasons that trace back to this difference.
> ..some random guys on the Internet
Essentially; and that's how everything starts. We've been in production since early last year and have maintained >99.99% availability. We're a certified partner with AWS, and have "qualified software" (it passed their security review), and our security posture report is available from AWS Marketplace. We aren't SOC-2 audited yet because we want to do it right rather than pay for a rubber-stamp report, and that takes time and a lot of money.
That being said: OK, so basically your service is to be treated as an Internet overlay. That can be fine. But then you should point the advantages of that. Using anycast and your internal peerings, are you better at routing packets than BGP on the open Internet? Are you able to hole-punch NAT to connect two NATted endpoints?
If so, this would be a service I might want to use.
As others have pointed out: End-To-End-Encryption with DTLS is possible by using SNI inspection on the Client Hello packet. You either do that and advertise this as a secure service OR you say "this is unreliable unencrypted transport, do your own thing over it".
I just don't think you are explaining your value proposition properly.
You can't proxy TLS for people without having the ability to see the decrypted data somewhere inside the server software/RAM. They (or a government) may or may not be looking at it or storing it, but the possibility is there.
No matter if you are using TLS over TCP (or HTTPS) or DTLS - end-to-end-encryption can be kept up simply by proxying on the first step of the Handshake.
That is the correct way how to do it.
We had CDNs for ages. They are fine for static content. But no, you should not proxy any confidential or personal data unencrypted through a third party, that is crazy. That stuff must be end-to-end encrypted between you and your peer.
I think the marketing terms here are blurring the vision of developers. You need to understand what you are doing. "Can this data be handed over to a man in the middle?" must be something you actively think about, then making a decision.
Yeah, why did you build this? It's unclear what the value proposition is, paying for a MitM proxy. It effectively means it cannot be used with secrets, without trusting y'all to not be snooping?
Yes, your point on security is correct. Since our service terminates the DTLS connection we could see the cleartext (just as any gateway service does, like AWS API Gateway, etc.). We don't touch it except as strictly needed to pass it to the configured integrations.
EDIT: FWIW, using a plain UDP handler you could implement DTLS handling that runs in your control, in which case payloads would be opaque to us. That's a bit of an effort, though. We were asked for this, so we built it.
Is that not exactly cloudflare?
I don’t understand how that could be the takeaway. The service is just what it says on the homepage: a way to make datagram transports compatible with event driven architecture and serverless. I don’t think the word “overlay” appears anywhere. I get your point, but thats not at all the positioning. The SDLC and operations are what it’s about.
> End-Encryption with DTLS is possible by using SNI inspection on the Client Hello
Sure. In simple cases even that’s not necessary if a listener is tied to a single endpoint, right? But again, this service probably isn’t ideal for such cases — it would work, but I, for one, don’t see why it would be useful.
I think that’s exactly it; an engineering decision based on the constraints at hand.
For the most part the technology (and society) we have it built on that resolving in favor of trusting 3rd parties to some degree.
If for example Cloudflare decided to offer this SNI-based TLS passthrough, they could no longer give you adequate DDoS protection, caching, analytics etc.
I know that you can not inspect content this way. But there simply are situations where content SHOULD NOT be inspected.
What you describe may be technically possible in a very narrow sense, for only specific types of DDoS attacks, but I don't see it being practical in most cases, plus I think ECH would make this difficult to do properly.
If you assume the origin speaks TLS and holds the cert/private key, and isn't using ESNI/ECH, then I suppose in a limited way it's possible. But...
> because they want to intercept all your traffic so the NSA gets a copy.
I don't believe that is the reason. I believe it's for features.
You need actual TLS termination to do most things CDNs and reverse proxies offer, such as:
- caching and compression
- WAF / bot detection
- URL-based routing
- header manipulation and redirects
- application-layer DDoS filtering
- analytics
- edge functions and content transformation
For the features you mention: Yes, you need meta-data for this. But you don't need to see the payload, a picture of my naked 4 year old kid.
FWIW, Proxylity supports plain UDP as well as DTLS so it’s possible to build a paas-through proxy for DTLS to Lambda, for example. But then you’ll need to implement DTLS in Lambda. People have done it, but it’s a heavy lift.
The idea with the DTLS support is protecting content in traffic, and the handling it in your own AWS account. For some cases it isn’t acceptable to have Proxylity or AWS to have any chance to seeing the data. But for the most it’s not a problem and the convenience of what the service provides is worth it.
But I hear the concern. I guess I just expect folks will make good decisions for their use cases.
Not everyone wants to (or their policy allows them to) manage TLS certs directly on their origin servers, and some services only allow plaintext HTTP origins, like AWS ALB/ELB. In that particular case it's "ok" because the load balancer is placed inside your VPC, so cleartext traffic is not visible to other customers or networks.
Also, ESNI/ECH would make TLS passthrough problematic.