3 ms·
Welcome to the internet -- what you actually just said was: "[The Cloud] is essentially a consensual man-in-the-middle and for certain threat models is not com
by xxdesmus 10y ago
Welcome to the internet -- what you actually just said was:
"[The Cloud] is essentially a consensual man-in-the-middle and for certain threat models is not compatible with the 'secure' modifier."
- CiPHPerCoder 10y agoThat's simultaneously wrong and misleading. "The Cloud" isn't a company that has direct access to a certificate authority. "The Cloud" doesn't produce a valid TLS certificate for YOUR website, to encrypt the connection between them and your visitors, but not necessarily between them and your server. "The Cloud" is a vague term for "other people's computers". CloudFlare is better than plaintext HTTP, but if your goal is confidentiality, then CloudFlare is probably worse than direct HTTPS with no intermediaries. Again, threat models differ. For most people, CloudFlare is probably just fine.