4 ms·
"Outsourcing TLS termination" is intentionally MitMing your users. Not really something to be happy about.
by clevernickname 10y ago
"Outsourcing TLS termination" is intentionally MitMing your users. Not really something to be happy about.
- johncolanduoni 10y agoIf you're outsourcing your TLS termination to the same people who are running your servers, you've barely made it easier for them to MITM your users. They could easily grab the private key off your server and do it anyway.
- clevernickname 10y agoThat's a big if. I was thinking about services like Cloudflare that terminate SSL close to the user, then tunnel the traffic to your servers. It cuts down on handshake latency and allows for secure distribution of cacheable content easily, but in return you are essentially handing your plaintext over to Cloudflare.