6 ms·

Step "What does secure mean anyway") SSL terminate even sites that are not sending data to Cloudflare securely

gkop 10y ago
Yup, this made it crystal clear, years ago, that Cloudflare's business incentives were and are at odds with a secure web.
- eridius 10y ago
  I don't buy this argument. A site using Flexible SSL is no less secure than one using http:// http://, and in fact is more secure, because nobody can MitM the connection between CloudFlare and the end user. The only thing vulnerable is the connection between the website and CloudFlare (~~and only to MitM, not to passive sniffing~~ EDIT: this isn't true, see [1]), but that's a much smaller and much better-protected surface area. Now it's quite obvious that the alternative SSL options are much better because they secure the data properly the whole way. But claiming that Flexible SSL is somehow undermining the security of the web is extremely hyperbolic. [1]: The connection between the origin server and CloudFlare can in fact be passively sniffed. I thought Flexible SSL was the option to use an arbitrary self-signed cert, but it actually means no encryption.
  - deleted 10y ago
    [deleted]
  - JoshTriplett 10y ago
    > A site using Flexible SSL is no less secure than one using http:// http://, It can be, in several ways. Most critically, it stops browsers from detecting the connection as insecure and applying mitigations.
    - eridius 10y ago
      Beyond Secure cookies, what mitigations are you thinking of? Secure cookies don't count because serving Secure cookies over Flexible SSL is no less secure than serving regular cookies over http:// http://.
      - tonyztan 10y ago
        Many browser features (like location API) are gradually being deprecated from plaintext HTTP.
        eridius 10y ago
        Interesting. I hadn't heard of that before. Looks like it's just Chrome doing this?
        richardwhiuk 10y ago
        And Firefox
      - JoshTriplett 10y ago
        In addition to limiting certain browser features to HTTPS sites, browsers now also warn about submitting passwords over HTTP and mark pages that do so as insecure. Browsers also prevent HTTPS sites from embedding active content from HTTP sites.
  - cdelsolar 10y ago
    Disagree. The point is that when people see that lock that tells you your connection is secure, when it's actually not, that causes more damage than if your connection was actually not secure (because then presumably you wouldn't be typing in credit card numbers and other sensitive info if you saw http:// http:// in your address bar).
    - eridius 10y ago
      See https://news.ycombinator.com/item?id=13719468 https://news.ycombinator.com/item?id=13719468.
  - lmm 10y ago
    The only thing the end user has is the difference between http:// http:// and https:// https://. Cloudflare undermines that entirely. How can a user possibly ever know whether it's safe to enter their credit card number or medical information in a web form, in a world where CloudFlare "Flexible SSL" exists?
    - eridius 10y ago
      If a user thinks the presence of "https" means it's safe to enter credit card details or medical information, that's already a huge problem. Yes, "https" should be a prerequisite to entering sensitive information, but that's only part of it; the other part is whether you actually trust the server you're sending that information to. The server could be using ironclad encryption across the whole connection, but that doesn't mean they'll still handle your data safely. Any site that wants sensitive information like this has to do many things to ensure it's secure, and making sure they have a secure connection is only one of those things. If you trust that the server operator has done everything else necessary to keep your credit card details safe, then you should also trust that they're not using Flexible SSL. Edit: Dear downvoters, can you please explain why you disagree? What I wrote really shouldn't be controversial in the least, so I don't understand the drive-by downvotes.
      - WillyOnWheels 10y ago
        Can you think of an existing system (let's go with websites) that meets your standards?
        vertex-four 10y ago
        There isn't an automated system that can tell you whether it's safe to give data to a website, just like there's no automated system which can tell you a given vendor/service provider in general is reputable. All you've got is regulations, human-based reputation ranking, and public shaming.
        eridius 10y ago
  - problems 10y ago
    Yeah, if you're capable of MITMing traffic between CloudFlare and the server, you're most likely capable of stealing emails or HTTP requests to the server anyways and generating your own certificate for them anyways. It's a security loss, but probably a minor one. The reality is, you're much more likely to get sniffed on public wifi or even your school or workplace network than someone running the server in a datacenter is, generally speaking if someone can sniff them at a DC they can do much more already. So it's still a respectably huge security gain for users. And they do offer a good way to secure this connection too where you can do full SSL and use a certificate signed by them. Would you be more comfortable if they offered another way to represent this to the browser? An X-Endpoint-Insecure header or something like that?
    - gkop 10y ago
      > Would you be more comfortable if they offered another way to represent this to the browser? An X-Endpoint-Insecure header or something like that? Yes, definitely, _Cloudflare_ should own this and push it through. You know they won't though because that would inconvenience their customers.
    - throwanem 10y ago
      I'd be more comfortable if they didn't lie about security to site visitors. "Configure a self-signed cert on your hosts so we can encrypt the traffic" is a low bar to clear.
- STRML 10y ago
  To my sibling: the issue is that people can and do consider Flexible SSL "good enough", when it really isn't. It gets you the green lock and the warm fuzzies, but the page just isn't secure. A false sense of security is worse than no security, because no security at least is glaringly obvious.
  - eridius 10y ago
    But it is secure. It's secure against the user being on an untrustworthy connection, it's secure against their ISP deciding to MitM their traffic, and it's also ~~secure against anyone passively sniffing the traffic between the website server and CloudFlare~~ (EDIT: No it's not, see [1]). The only thing it's not secure against is someone in a privileged network position who can MitM the connection between the website and CloudFlare. So no, it's not 100% secure, but it's far far better than having an unsecured http:// http:// connection. As for the green lock, you can blame that on Chrome. I have no idea why they insist on using a green lock and green "Secure" text for DV certs. Safari only uses a green lock / green text for EV certs, which is a lot better (and I don't know offhand what Firefox or Edge do). Of course, you could have an EV cert and still use Flexible SSL, but anyone who cares enough to get an EV cert should know better than to use Flexible SSL anyway, and there's a great many ways to make your server insecure, using Flexible SSL is very far from the worst way. All that said, it would be great if CloudFlare would just stop offering Flexible SSL in favor of the self-signed CSR approach. Any CloudFlare customer who can create their own cert to talk to CloudFlare can also create a CSR to get a cert from CloudFlare just as easily, so it's not clear to me why they still even offer Flexible SSL. [1]: I thought Flexible SSL was the option to use an arbitrary self-signed cert on the origin server. gkop pointed out that, no, Flexible SSL means no encryption at all.
    - gkop 10y ago
      > it's also secure against anyone passively sniffing the traffic between the website server and CloudFlare How is it secure? CloudFlare allows you to send this traffic in the clear. If they required this traffic be HTTPS, that would be far better for web security.

gkop 10y ago

Yup, this made it crystal clear, years ago, that Cloudflare's business incentives were and are at odds with a secure web.

eridius 10y ago
I don't buy this argument. A site using Flexible SSL is no less secure than one using http:// http://, and in fact is more secure, because nobody can MitM the connection between CloudFlare and the end user. The only thing vulnerable is the connection between the website and CloudFlare (~~and only to MitM, not to passive sniffing~~ EDIT: this isn't true, see [1]), but that's a much smaller and much better-protected surface area. Now it's quite obvious that the alternative SSL options are much better because they secure the data properly the whole way. But claiming that Flexible SSL is somehow undermining the security of the web is extremely hyperbolic. [1]: The connection between the origin server and CloudFlare can in fact be passively sniffed. I thought Flexible SSL was the option to use an arbitrary self-signed cert, but it actually means no encryption.
- deleted 10y ago
  [deleted]
- JoshTriplett 10y ago
  > A site using Flexible SSL is no less secure than one using http:// http://, It can be, in several ways. Most critically, it stops browsers from detecting the connection as insecure and applying mitigations.
  - eridius 10y ago
    Beyond Secure cookies, what mitigations are you thinking of? Secure cookies don't count because serving Secure cookies over Flexible SSL is no less secure than serving regular cookies over http:// http://.
    - tonyztan 10y ago
      Many browser features (like location API) are gradually being deprecated from plaintext HTTP.
      - eridius 10y ago
        Interesting. I hadn't heard of that before. Looks like it's just Chrome doing this?
        richardwhiuk 10y ago
        And Firefox
    - JoshTriplett 10y ago
      In addition to limiting certain browser features to HTTPS sites, browsers now also warn about submitting passwords over HTTP and mark pages that do so as insecure. Browsers also prevent HTTPS sites from embedding active content from HTTP sites.
- cdelsolar 10y ago
  Disagree. The point is that when people see that lock that tells you your connection is secure, when it's actually not, that causes more damage than if your connection was actually not secure (because then presumably you wouldn't be typing in credit card numbers and other sensitive info if you saw http:// http:// in your address bar).
  - eridius 10y ago
    See https://news.ycombinator.com/item?id=13719468 https://news.ycombinator.com/item?id=13719468.
- lmm 10y ago
  The only thing the end user has is the difference between http:// http:// and https:// https://. Cloudflare undermines that entirely. How can a user possibly ever know whether it's safe to enter their credit card number or medical information in a web form, in a world where CloudFlare "Flexible SSL" exists?
  - eridius 10y ago
    If a user thinks the presence of "https" means it's safe to enter credit card details or medical information, that's already a huge problem. Yes, "https" should be a prerequisite to entering sensitive information, but that's only part of it; the other part is whether you actually trust the server you're sending that information to. The server could be using ironclad encryption across the whole connection, but that doesn't mean they'll still handle your data safely. Any site that wants sensitive information like this has to do many things to ensure it's secure, and making sure they have a secure connection is only one of those things. If you trust that the server operator has done everything else necessary to keep your credit card details safe, then you should also trust that they're not using Flexible SSL. Edit: Dear downvoters, can you please explain why you disagree? What I wrote really shouldn't be controversial in the least, so I don't understand the drive-by downvotes.
    - WillyOnWheels 10y ago
      Can you think of an existing system (let's go with websites) that meets your standards?
      - vertex-four 10y ago
        There isn't an automated system that can tell you whether it's safe to give data to a website, just like there's no automated system which can tell you a given vendor/service provider in general is reputable. All you've got is regulations, human-based reputation ranking, and public shaming.
        eridius 10y ago
- problems 10y ago
  Yeah, if you're capable of MITMing traffic between CloudFlare and the server, you're most likely capable of stealing emails or HTTP requests to the server anyways and generating your own certificate for them anyways. It's a security loss, but probably a minor one. The reality is, you're much more likely to get sniffed on public wifi or even your school or workplace network than someone running the server in a datacenter is, generally speaking if someone can sniff them at a DC they can do much more already. So it's still a respectably huge security gain for users. And they do offer a good way to secure this connection too where you can do full SSL and use a certificate signed by them. Would you be more comfortable if they offered another way to represent this to the browser? An X-Endpoint-Insecure header or something like that?
  - gkop 10y ago
    > Would you be more comfortable if they offered another way to represent this to the browser? An X-Endpoint-Insecure header or something like that? Yes, definitely, _Cloudflare_ should own this and push it through. You know they won't though because that would inconvenience their customers.
  - throwanem 10y ago
    I'd be more comfortable if they didn't lie about security to site visitors. "Configure a self-signed cert on your hosts so we can encrypt the traffic" is a low bar to clear.
STRML 10y ago
To my sibling: the issue is that people can and do consider Flexible SSL "good enough", when it really isn't. It gets you the green lock and the warm fuzzies, but the page just isn't secure. A false sense of security is worse than no security, because no security at least is glaringly obvious.
- eridius 10y ago
  But it is secure. It's secure against the user being on an untrustworthy connection, it's secure against their ISP deciding to MitM their traffic, and it's also ~~secure against anyone passively sniffing the traffic between the website server and CloudFlare~~ (EDIT: No it's not, see [1]). The only thing it's not secure against is someone in a privileged network position who can MitM the connection between the website and CloudFlare. So no, it's not 100% secure, but it's far far better than having an unsecured http:// http:// connection. As for the green lock, you can blame that on Chrome. I have no idea why they insist on using a green lock and green "Secure" text for DV certs. Safari only uses a green lock / green text for EV certs, which is a lot better (and I don't know offhand what Firefox or Edge do). Of course, you could have an EV cert and still use Flexible SSL, but anyone who cares enough to get an EV cert should know better than to use Flexible SSL anyway, and there's a great many ways to make your server insecure, using Flexible SSL is very far from the worst way. All that said, it would be great if CloudFlare would just stop offering Flexible SSL in favor of the self-signed CSR approach. Any CloudFlare customer who can create their own cert to talk to CloudFlare can also create a CSR to get a cert from CloudFlare just as easily, so it's not clear to me why they still even offer Flexible SSL. [1]: I thought Flexible SSL was the option to use an arbitrary self-signed cert on the origin server. gkop pointed out that, no, Flexible SSL means no encryption at all.
  - gkop 10y ago
    > it's also secure against anyone passively sniffing the traffic between the website server and CloudFlare How is it secure? CloudFlare allows you to send this traffic in the clear. If they required this traffic be HTTPS, that would be far better for web security.