Tell HN: Cloudflare silently injects its analytics when you switch nameservers (undefined)
102 points by stagas 2 hours ago
A few hours ago I switched my nameservers to Cloudflare in order to enable R2 bucket serving through my own subdomain, and I found out that it silently had injected a JS analytics snippet in my HTML-only JS-free site textlog.cc — I had to go to the Analytics dashboard, Add the site to the analytics and then disable the snippet. I find this approach entirely invasive, you should opt-in to features like that not have to opt-out. Just a warning out there to folks who might not be aware of this.
Animats 2 minutes ago
> injected a JS analytics snippet in my HTML-only JS-free site textlog.cc
Cloudflare injected hostile code into a site they are not even hosting? If it's HTTPS, how do they even do that?
Does it violate the "exceeds authorized access" provision in the Computer Fraud and Abuse Act?
purpleidea an hour ago
Yikes! I see this too:
<script type="module" src="https://static.cloudflareinsights.com/beacon.min.js/v4513226..." integrity="sha512-ZE9pZaUXND66v380QUtch/5sE9tPFh2zg45pR2PB0CVkCtOREv2AJKkSidISWkysEuQ0EH8faUU5du78bx87UQ==" data-cf-beacon='{"version":"2024.11.0","token":"c0859b51a7804ab5a9cc8e9e2b2c4cde","r":1}' crossorigin="anonymous"></script>
outlines 4 minutes ago
Are you using CF as a proxy or only for DNS? I ask because I just went to check my domains on the dashboard (some purchased a few years ago, one purchased just a couple days ago), and none of them have Web Analytics enabled.
I have all my domains set to DNS only, so no CF proxy. Wondering if that is why?
stagas 2 minutes ago
I just went and switched them to DNS only, they were on Proxy by default, that also should have been opt-in. Maybe I missed the option while switching the nameservers because I did it in a hurry but still.
celsoazevedo an hour ago
Yes, they add the js if "web analytics" is enabled. I believe I had to manually enable it on my old sites though. Maybe it's enabled by default when adding new domains?
stagas 4 minutes ago
No, I hadn’t enabled for any site. I had to enable first to turn it off.
dchest 43 minutes ago
ValentineC an hour ago
Took me a minute to realise this isn't 1.1.1.1 (which Cloudflare also runs), but their original website DNS hosting service.
minraws 36 minutes ago
Is there an opt-out mechanism at least? CF is burning goodwill in months it built over the last decade.
BorisMelnik 40 minutes ago
yep, last website I did was JS free 100% except that pesky cloudflare script
windexh8er an hour ago
Isn't this well known when using CF as a proxy? Not sure how they would provide traffic / DDoS telemetry otherwise.
JoshTriplett 39 minutes ago
They're serving the HTML, they have every ability to track individual web requests without modifying the content they're serving.
sscaryterry 34 minutes ago
100% But this does not give you any useful personal data :)
JoshTriplett 32 minutes ago
yogorenapan 6 minutes ago
Noticed this the other day as well. Sketchy as fuck. I didn't have analytics enabled. I had to go and enable to get access to the option to turn this off
pudgywalsh 43 minutes ago
You left out the part about how you use them as a reverse proxy, which is decoupled from DNS. One is coincidental; the other required.
If they can inject script, they can also snoop on all your cleartext traffic without you knowing....
stagas 18 minutes ago
Oh gosh I didn’t enable anything like that also. I just wanted the nameservers in order to serve the bucket under my subdomain. What else is there I wonder?
stagas 5 minutes ago
Ok to turn this off you go Domains → Overview → your.site → DNS → Records → then Edit each entry to DNS Only (gray cloud). MITM gone now (I hope).
johntash 36 minutes ago
Indeed. I have several domains using cf for dns only and they don't/can't inject anything into those sites.
csomar an hour ago
To add to your experience: It was also very hard, for me, to find the setting that disables this JavaScript.
moktonar an hour ago
Surprise! The man in the middle man-in-the-middles! This is only the beginning, when you’ll get used to this they’ll do worse and worse, enshittification, remember?
_def 39 minutes ago
If I wouldn't know it better I'd sometimes think some of the big tech shops are just fronts for centralizing the net.
LoganDark 21 minutes ago
Cloudflare is doing this already. Once they had enough monopoly power, they started a program to block all bots that don't undergo invasive KYC procedures. Eventually, they might become a KYC broker for regular browser users too. The free internet is over.