I think that Cloudflare might be a U.S. government tool to crack encryption
Why would the government need something like Cloudflare?

We are living in the era of the big data analytics [1].

When data is collected through means of traffic-sniffing by a man-in-the-middle, such as government agencies, a big problem they face is encryption.

The NSA has already sorted out the part of how to "collect data", but with the big push for encryption after Snowden came out, they collect a bunch of encrypted data that they can't use, even with decryption programs such as BULLRUN[2].

Cloudflare is the only thing that can break encryption on a large scale, as it holds the SSL encryption for both ends of the connection, since it is a man-in-the-middle itself by definition.

Didn't Matthew Prince and 2 others invented Cloudflare?

Kind of. Cloudflare was actually kicked-off by the Department of Homeland Security.

> Back in 2003, Lee Holloway and I started Project Honey Pot as an open-source project to track online fraud and abuse. The Project allowed anyone > with a website to install a piece of code and track hackers and spammers. We ran it as a hobby and didn't think much about it until, in 2008, the > Department of Homeland Security called and said, 'Do you have any idea how valuable the data you have is?' That started us thinking about how we > could effectively deploy the data from Project Honey Pot, as well as other sources, in order to protect websites online. That turned into the initial impetus for CloudFlare.

Fast forward 1 and a half year from that call, and Cloudflare was a fully-fledged application integrated with tech giants such as Hostgator. They were tremendously efficient to develop the tool and commercialize it so fast. I think they got help.

Some interesting facts about Cloudflare:

- It launched in Oct 1, 2010[3]. The Department of Homeland Security did the kick-off call[4] around 2008~2009.
- In 2017, Cloudflare estimated[5] to proxy around 10% of all the traffic of the internet.
- Only 4~5% of the sites it protects are paying customers[6]. (Subjective: If you aren't paying, you are the product)

> "Our vision is that we are going to power the internet"
> Matthew Prince, at the Cloudflare launch[7] on TechCrunch on 2010.

It's a bold statement for a company that wasn't even being considered to be created a couple months before.

There's no mention about the kick-off from the Department of Homeland Security in 2008~2009 in Cloudflare's Our Story[8] page or Wikipedia[9].

This is weird, as Cloudflare wouldn't exist without them.

Who built Cloudflare?

One important question that I'd like to know is, what exactly happened between that call from the Department of Homeland Security in 2008~2009 and the launch in Oct 1, 2010?

Who built the basis for Cloudflare infrastructure? Who were the first employees?

You can see in the 2010 launch video that Cloudflare was already a mature product at launch, with the basis to achieve the ambition of "powering the internet" from day one, with a seamless integration with Hostgator, which powered 2% of the internet traffic at the time.

You need highly skilled personnel to put that off, how did a Harvard student pull that out in one year? (In this case, Lee)

Questions:

- Am I correct to assume Cloudflare acts as a reverse proxy with upstream SSL, thus being able to see decrypted communication between both ends of a request?

- Am I correct to assume Cloudflare bypasses encryption on a large scale, having access to unencrypted content for all requests/responses it handles? (10% of the internet[10])

- Am I correct to assume this is the only way of breaking encryption at large scale and still be able to do Big Data analytics with raw traffic sniffing, such as what NSA has been disclosed by Snowden to be doing?

Reference Links

The Reference Links and the remaining 2 questions can be found here, because of the 4k char limit: https://pastebin.com/9hYtzcPa