I really hate to be that guy, but I'm afraid that Cloudflare partnering with every browser to offer a VPN is just going to draw the attention of authorities, who would force them to install their censorship policies and force flow logging on all proxying services of this kind, effectively killing the purpose of such services.
There is already precedent for this happening in Russia; in that incident every VPN pulled out of the country. However if everyone enforces it, it's gonna be hard.
--
From a purely technical perspective this seems to equivalent to Apple Private Relay _iff_ the operator for the ingress and egress are two different endpoints, which it is not clear from the presentation.
In the case of APR Apple has their own servers (mask-h2.icloud.com) that accepts connections and obscures the IP <-> website mapping for their exit relay providers, who are Cloudflare, Akamai and Fastly at the moment.
If they are the same operator, because of the ClientHello permutation in Chromium based browsers[1] such as Edge, Cloudflare gets a high-entropy identifier + IP address, which, along with SNI header inspection, could be theoretically used to identify individual users.
[1] https://www.fastly.com/blog/a-first-look-at-chromes-tls-clie...
There is already precedent for this happening in Russia; in that incident every VPN pulled out of the country. However if everyone enforces it, it's gonna be hard.
--
From a purely technical perspective this seems to equivalent to Apple Private Relay _iff_ the operator for the ingress and egress are two different endpoints, which it is not clear from the presentation.
In the case of APR Apple has their own servers (mask-h2.icloud.com) that accepts connections and obscures the IP <-> website mapping for their exit relay providers, who are Cloudflare, Akamai and Fastly at the moment.
If they are the same operator, because of the ClientHello permutation in Chromium based browsers[1] such as Edge, Cloudflare gets a high-entropy identifier + IP address, which, along with SNI header inspection, could be theoretically used to identify individual users.
[1] https://www.fastly.com/blog/a-first-look-at-chromes-tls-clie...