5 ms·

Nearly everything in this post is FUD. The only accurate part is that Cloudflare is indeed a MitM no matter what SSL mode you have enabled. An intelligence age

by rudolf0 10y ago

Nearly everything in this post is FUD. The only accurate part is that Cloudflare is indeed a MitM no matter what SSL mode you have enabled. An intelligence agency that thoroughly compromises Cloudflare's interception points would be able to ignore SSL for a lot of large websites. That's just a trade-off you have to decide is worth it or not before signing up.

joepie91_ 10y ago
So specifically what claims in the article do you believe to be "FUD"? Concrete examples, no hand-wavy claims.
Animats 10y ago
I've commented on this before. Cloudflare is MITM-as-a-service. Think of it as a form of security theater. If you're going to use encryption, don't outsource your public key.
- manigandham 10y ago
  Every CDN is a MITM as a service. There are business benefits to that service which make sense. Yes CF has the "flexible SSL" option which is one of their risks but ultimately it comes down to the person using the tool.
  - Animats 10y ago
    If you care about security, you need to bypass the CDN for login pages or pages that accept credit cards. All images, CSS, and Javascript should have subresource integrity hashes. Then content tampering is likely to be noticed by somebody.
    - manigandham 10y ago
      No, that's a false way to start with "if you care about security" - Everyone cares about security, not doing what you say doesn't mean I don't. There are different risks and tolerances for every business and different ways to deal with this. Ultimately everyone can be compromised from the ISP, CDN, web host or even the network equipment maker. The vast majority of time, these other vendors will be much more secure than doing it yourself. If you accept credit cards, the last thing you should be doing is storing those numbers yourself, this is why we have PCI compliance and other certifications so that trust and capability can be measured and relied on.

by rudolf0 10y ago

joepie91_ 10y ago

So specifically what claims in the article do you believe to be "FUD"? Concrete examples, no hand-wavy claims.

Animats 10y ago

I've commented on this before. Cloudflare is MITM-as-a-service. Think of it as a form of security theater. If you're going to use encryption, don't outsource your public key.

manigandham 10y ago
Every CDN is a MITM as a service. There are business benefits to that service which make sense. Yes CF has the "flexible SSL" option which is one of their risks but ultimately it comes down to the person using the tool.
- Animats 10y ago
  If you care about security, you need to bypass the CDN for login pages or pages that accept credit cards. All images, CSS, and Javascript should have subresource integrity hashes. Then content tampering is likely to be noticed by somebody.
  - manigandham 10y ago
    No, that's a false way to start with "if you care about security" - Everyone cares about security, not doing what you say doesn't mean I don't. There are different risks and tolerances for every business and different ways to deal with this. Ultimately everyone can be compromised from the ISP, CDN, web host or even the network equipment maker. The vast majority of time, these other vendors will be much more secure than doing it yourself. If you accept credit cards, the last thing you should be doing is storing those numbers yourself, this is why we have PCI compliance and other certifications so that trust and capability can be measured and relied on.