4 ms·
The takeaway from the Cloudflare story seems to be: don't rely on TLS encryption for critical data, since it may be compromised by third-party actions and may b
by dmytrish 10y ago
The takeaway from the Cloudflare story seems to be: don't rely on TLS encryption for critical data, since it may be compromised by third-party actions and may be completely compromised in the future.
- tialaramex 10y agoHuh? Cloudflare's screw-up had no impact on third parties. What it did was cause havoc for Cloudflare's own _customers_ who had agreed Cloudflare could purposefully MITM them. For it to function at all, Cloudflare undoes all the TLS encryption, signing up for Cloudflare means saying "Yeah, Cloudflare now has total control of my web site, I don't care, I'm sure these people I've never met are competent and will protect my site and its users". I guess that's OK if you're running a blog about your cat ? But millions of people decided it sounded pretty good for their business or private data. -shrug-