3 ms·
I wonder how it's even allowed for CF to do this. "your site" <--- http ---> CF <--- https ---> clients is a poor solution and it only hides that the connection
by leni536 11y ago
I wonder how it's even allowed for CF to do this. "your site" <--- http ---> CF <--- https ---> clients is a poor solution and it only hides that the connection is actually not secure. Isn't this a misuse of many CA's TOS and should result in certificate revocation? Maybe I'm wrong though.
- Zarel 11y agoWell, at least for several threat models, "your site to CF" is at least slightly better than "CF to clients". It's not vulnerable to things like unsecured wi-fi sniffing. Then again, neither are self-signed certs and for some reason all browsers consider them even worse than no cert. On the other hand, it doesn't protect against government spying, but then again, I think some governments straight-up MitM HTTPS traffic anyway. For instance: https://news.ycombinator.com/item?id=10663843 https://news.ycombinator.com/item?id=10663843