4 ms·

>I am trying to explain to him why this is bad, but he doesn't really care. "You are losing sales. People look for the lock icon on the address bar." Also, h

>I am trying to explain to him why this is bad, but he doesn't really care. "You are losing sales. People look for the lock icon on the address bar." Also, he can get SSL on his site for FREE in < 5 minutes using Cloudflare.

stevenhubertron 11y ago
Thats a good point. I don't want to open the can of words and add SSL myself, some interesting things to think about for sure.
gojomo 11y ago
Cloudflare may be a good option for him. But, the quick and free Cloudflare SSL would still be non-SSL from Cloudflare to his site – an improvement against many home/public-Wifi threats but not a total fix (nor true compliance with credit-card agreements). Also, for a totally non-technical person, it will take – and be billed as – more than 5 minutes of someone else's time to get even that free half-measure into effect.
- brobinson 11y ago
  Good points. That raises an interesting question: how could a person determine if the connection between an edge (say, Cloudflare) and the destination server is actually encrypted? I can't think of a way to do this unless you know the address of the true IP of the destination and poke it on the SSL port. That still doesn't guarantee SSL is being used, though.
  - gojomo 11y ago
    In general there's no way to know: you have to trust the destination's internal choices, once you've reached their chosen perimeter. In my opinion best practice would be to obscure what the "true IP" of the backend server is, and only accept connections from Cloudflare. (I don't know if Cloudflare offers any options for this stronger than trusting their IP ranges, such as a client certificate on their outbound-SSL.) So if you could "poke [the true origin] on the SSL port", that could itself be evidence of suboptimal security.
    - brobinson 11y ago
      >obscure what the "true IP" of the backend server is, and only accept connections from Cloudflare This is what I was planning to do when I launch the app I'm working on now. Thanks for the reply.

stevenhubertron 11y ago

Thats a good point. I don't want to open the can of words and add SSL myself, some interesting things to think about for sure.

gojomo 11y ago

Cloudflare may be a good option for him. But, the quick and free Cloudflare SSL would still be non-SSL from Cloudflare to his site – an improvement against many home/public-Wifi threats but not a total fix (nor true compliance with credit-card agreements). Also, for a totally non-technical person, it will take – and be billed as – more than 5 minutes of someone else's time to get even that free half-measure into effect.

brobinson 11y ago
Good points. That raises an interesting question: how could a person determine if the connection between an edge (say, Cloudflare) and the destination server is actually encrypted? I can't think of a way to do this unless you know the address of the true IP of the destination and poke it on the SSL port. That still doesn't guarantee SSL is being used, though.
- gojomo 11y ago
  In general there's no way to know: you have to trust the destination's internal choices, once you've reached their chosen perimeter. In my opinion best practice would be to obscure what the "true IP" of the backend server is, and only accept connections from Cloudflare. (I don't know if Cloudflare offers any options for this stronger than trusting their IP ranges, such as a client certificate on their outbound-SSL.) So if you could "poke [the true origin] on the SSL port", that could itself be evidence of suboptimal security.
  - brobinson 11y ago
    >obscure what the "true IP" of the backend server is, and only accept connections from Cloudflare This is what I was planning to do when I launch the app I'm working on now. Thanks for the reply.