3 ms·

CloudFlare strips HTTPS protection off on their machines and views all plain text. So, you get HTTPS protection on the public Internet in exchange for CloudFlar

CloudFlare strips HTTPS protection off on their machines and views all plain text. So, you get HTTPS protection on the public Internet in exchange for CloudFlare getting to see everything. This may or may not be what you want/need.

Kalium 11y ago
It's worth remembering that that's one operating mode. There are others.
- hueving 11y ago
  If they can cache it, they can read it.
  - Kalium 11y ago
    Then I shall restate with greater precision. The operating mode described by the comment to which I was responding, that of CloudFlare performing all steps of SSL termination, is one operating mode available. CloudFlare offers at least one other operating mode in which they are not responsible for all aspects of SSL termination. In particular, they offer an operating mode in which they do not hold private keys. This is referred to as "Keyless SSL". Thus the concern voiced by the comment to which I was responding, that of CloudFlare stripping SSL, is but one available option rather than the only available option. Clearer?
    - duskwuff 11y ago
      Keyless SSL only prevents CloudFlare from having access to SSL key material. They can still read and modify any traffic that passes through them.
      - Kalium 11y ago
        True, but this isn't the concern I was addressing. And sometimes modifying is a desirable feature.
    - jsprogrammer 11y ago
      "Keyless SSL" is a bit of a misnomer. CloudFlare still holds the keys to encrypt and decrypt the content it is distributing and therefore sees everything (they can inject into your traffic as well). Even if they don't hold the private key, they can act in every way as if they did hold the private key.
secabeen 11y ago
Given what we learned from the NSA sniffing inter-datacenter communications within Google, do we really want wide scale solutions that rely on removing the SSL layer?
- steckerbrett 11y ago
  SSL added and removed at CloudFlare :)

Kalium 11y ago

It's worth remembering that that's one operating mode. There are others.

hueving 11y ago
If they can cache it, they can read it.
- Kalium 11y ago
  Then I shall restate with greater precision. The operating mode described by the comment to which I was responding, that of CloudFlare performing all steps of SSL termination, is one operating mode available. CloudFlare offers at least one other operating mode in which they are not responsible for all aspects of SSL termination. In particular, they offer an operating mode in which they do not hold private keys. This is referred to as "Keyless SSL". Thus the concern voiced by the comment to which I was responding, that of CloudFlare stripping SSL, is but one available option rather than the only available option. Clearer?
  - duskwuff 11y ago
    Keyless SSL only prevents CloudFlare from having access to SSL key material. They can still read and modify any traffic that passes through them.
    - Kalium 11y ago
      True, but this isn't the concern I was addressing. And sometimes modifying is a desirable feature.
  - jsprogrammer 11y ago
    "Keyless SSL" is a bit of a misnomer. CloudFlare still holds the keys to encrypt and decrypt the content it is distributing and therefore sees everything (they can inject into your traffic as well). Even if they don't hold the private key, they can act in every way as if they did hold the private key.

secabeen 11y ago

Given what we learned from the NSA sniffing inter-datacenter communications within Google, do we really want wide scale solutions that rely on removing the SSL layer?

steckerbrett 11y ago
SSL added and removed at CloudFlare :)