4 ms·

I don't buy this argument. A site using Flexible SSL is no less secure than one using http:// http://, and in fact is more secure, because nobody can MitM the

by eridius 10y ago

I don't buy this argument. A site using Flexible SSL is no less secure than one using http:// http://, and in fact is more secure, because nobody can MitM the connection between CloudFlare and the end user. The only thing vulnerable is the connection between the website and CloudFlare (~~and only to MitM, not to passive sniffing~~ EDIT: this isn't true, see [1]), but that's a much smaller and much better-protected surface area. Now it's quite obvious that the alternative SSL options are much better because they secure the data properly the whole way. But claiming that Flexible SSL is somehow undermining the security of the web is extremely hyperbolic. [1]: The connection between the origin server and CloudFlare can in fact be passively sniffed. I thought Flexible SSL was the option to use an arbitrary self-signed cert, but it actually means no encryption.

deleted 10y ago
[deleted]
JoshTriplett 10y ago
> A site using Flexible SSL is no less secure than one using http:// http://, It can be, in several ways. Most critically, it stops browsers from detecting the connection as insecure and applying mitigations.
- eridius 10y ago
  Beyond Secure cookies, what mitigations are you thinking of? Secure cookies don't count because serving Secure cookies over Flexible SSL is no less secure than serving regular cookies over http:// http://.
  - tonyztan 10y ago
    Many browser features (like location API) are gradually being deprecated from plaintext HTTP.
    - eridius 10y ago
      Interesting. I hadn't heard of that before. Looks like it's just Chrome doing this?
      - richardwhiuk 10y ago
        And Firefox
  - JoshTriplett 10y ago
    In addition to limiting certain browser features to HTTPS sites, browsers now also warn about submitting passwords over HTTP and mark pages that do so as insecure. Browsers also prevent HTTPS sites from embedding active content from HTTP sites.
cdelsolar 10y ago
Disagree. The point is that when people see that lock that tells you your connection is secure, when it's actually not, that causes more damage than if your connection was actually not secure (because then presumably you wouldn't be typing in credit card numbers and other sensitive info if you saw http:// http:// in your address bar).
- eridius 10y ago
  See https://news.ycombinator.com/item?id=13719468 https://news.ycombinator.com/item?id=13719468.
lmm 10y ago
The only thing the end user has is the difference between http:// http:// and https:// https://. Cloudflare undermines that entirely. How can a user possibly ever know whether it's safe to enter their credit card number or medical information in a web form, in a world where CloudFlare "Flexible SSL" exists?
- eridius 10y ago
  If a user thinks the presence of "https" means it's safe to enter credit card details or medical information, that's already a huge problem. Yes, "https" should be a prerequisite to entering sensitive information, but that's only part of it; the other part is whether you actually trust the server you're sending that information to. The server could be using ironclad encryption across the whole connection, but that doesn't mean they'll still handle your data safely. Any site that wants sensitive information like this has to do many things to ensure it's secure, and making sure they have a secure connection is only one of those things. If you trust that the server operator has done everything else necessary to keep your credit card details safe, then you should also trust that they're not using Flexible SSL. Edit: Dear downvoters, can you please explain why you disagree? What I wrote really shouldn't be controversial in the least, so I don't understand the drive-by downvotes.
  - WillyOnWheels 10y ago
    Can you think of an existing system (let's go with websites) that meets your standards?
    - vertex-four 10y ago
      There isn't an automated system that can tell you whether it's safe to give data to a website, just like there's no automated system which can tell you a given vendor/service provider in general is reputable. All you've got is regulations, human-based reputation ranking, and public shaming.
      - eridius 10y ago
problems 10y ago
Yeah, if you're capable of MITMing traffic between CloudFlare and the server, you're most likely capable of stealing emails or HTTP requests to the server anyways and generating your own certificate for them anyways. It's a security loss, but probably a minor one. The reality is, you're much more likely to get sniffed on public wifi or even your school or workplace network than someone running the server in a datacenter is, generally speaking if someone can sniff them at a DC they can do much more already. So it's still a respectably huge security gain for users. And they do offer a good way to secure this connection too where you can do full SSL and use a certificate signed by them. Would you be more comfortable if they offered another way to represent this to the browser? An X-Endpoint-Insecure header or something like that?
- gkop 10y ago
  > Would you be more comfortable if they offered another way to represent this to the browser? An X-Endpoint-Insecure header or something like that? Yes, definitely, _Cloudflare_ should own this and push it through. You know they won't though because that would inconvenience their customers.
- throwanem 10y ago
  I'd be more comfortable if they didn't lie about security to site visitors. "Configure a self-signed cert on your hosts so we can encrypt the traffic" is a low bar to clear.

by eridius 10y ago

deleted 10y ago

[deleted]

JoshTriplett 10y ago

> A site using Flexible SSL is no less secure than one using http:// http://, It can be, in several ways. Most critically, it stops browsers from detecting the connection as insecure and applying mitigations.

eridius 10y ago
Beyond Secure cookies, what mitigations are you thinking of? Secure cookies don't count because serving Secure cookies over Flexible SSL is no less secure than serving regular cookies over http:// http://.
- tonyztan 10y ago
  Many browser features (like location API) are gradually being deprecated from plaintext HTTP.
  - eridius 10y ago
    Interesting. I hadn't heard of that before. Looks like it's just Chrome doing this?
    - richardwhiuk 10y ago
      And Firefox
- JoshTriplett 10y ago
  In addition to limiting certain browser features to HTTPS sites, browsers now also warn about submitting passwords over HTTP and mark pages that do so as insecure. Browsers also prevent HTTPS sites from embedding active content from HTTP sites.

cdelsolar 10y ago

Disagree. The point is that when people see that lock that tells you your connection is secure, when it's actually not, that causes more damage than if your connection was actually not secure (because then presumably you wouldn't be typing in credit card numbers and other sensitive info if you saw http:// http:// in your address bar).

eridius 10y ago
See https://news.ycombinator.com/item?id=13719468 https://news.ycombinator.com/item?id=13719468.

lmm 10y ago

The only thing the end user has is the difference between http:// http:// and https:// https://. Cloudflare undermines that entirely. How can a user possibly ever know whether it's safe to enter their credit card number or medical information in a web form, in a world where CloudFlare "Flexible SSL" exists?

eridius 10y ago
If a user thinks the presence of "https" means it's safe to enter credit card details or medical information, that's already a huge problem. Yes, "https" should be a prerequisite to entering sensitive information, but that's only part of it; the other part is whether you actually trust the server you're sending that information to. The server could be using ironclad encryption across the whole connection, but that doesn't mean they'll still handle your data safely. Any site that wants sensitive information like this has to do many things to ensure it's secure, and making sure they have a secure connection is only one of those things. If you trust that the server operator has done everything else necessary to keep your credit card details safe, then you should also trust that they're not using Flexible SSL. Edit: Dear downvoters, can you please explain why you disagree? What I wrote really shouldn't be controversial in the least, so I don't understand the drive-by downvotes.
- WillyOnWheels 10y ago
  Can you think of an existing system (let's go with websites) that meets your standards?
  - vertex-four 10y ago
    There isn't an automated system that can tell you whether it's safe to give data to a website, just like there's no automated system which can tell you a given vendor/service provider in general is reputable. All you've got is regulations, human-based reputation ranking, and public shaming.
    - eridius 10y ago

problems 10y ago

Yeah, if you're capable of MITMing traffic between CloudFlare and the server, you're most likely capable of stealing emails or HTTP requests to the server anyways and generating your own certificate for them anyways. It's a security loss, but probably a minor one. The reality is, you're much more likely to get sniffed on public wifi or even your school or workplace network than someone running the server in a datacenter is, generally speaking if someone can sniff them at a DC they can do much more already. So it's still a respectably huge security gain for users. And they do offer a good way to secure this connection too where you can do full SSL and use a certificate signed by them. Would you be more comfortable if they offered another way to represent this to the browser? An X-Endpoint-Insecure header or something like that?

gkop 10y ago
> Would you be more comfortable if they offered another way to represent this to the browser? An X-Endpoint-Insecure header or something like that? Yes, definitely, _Cloudflare_ should own this and push it through. You know they won't though because that would inconvenience their customers.
throwanem 10y ago
I'd be more comfortable if they didn't lie about security to site visitors. "Configure a self-signed cert on your hosts so we can encrypt the traffic" is a low bar to clear.