4 ms·
Company engaging in practices that undermine internet security and MITM their users found to be doing stupid shit. Not exactly breaking news. At some point, ma
by pikzen 10y ago
Company engaging in practices that undermine internet security and MITM their users found to be doing stupid shit.
Not exactly breaking news. At some point, maybe people will realise that CF is actively making internet worse and less secure, and that it should be treated as nothing more than a wart to be removed.
- manigandham 10y agoEvery CDN that handles TLS traffic is a MITM.
- gkop 10y agoWhat other CDN makes it easy to use plaintext between the CDN and origin, yet use a secure connection between the CDN and the end user, and has the nerve to market this as a feature called "Flexible SSL"? Edit: I wasn't very clear. GP is wrong saying MITM is "wrong" for its own sake. I think Cloudflare is harmful for other reasons though.
- sondh 10y agoThis incident affects Full SSL sites too.
- manigandham 10y agoThat does seem to be an accurate name, it is a feature that's offered and up to the site operator to enable, and yes it's unfortunate that it potentially gives a false sense of security to end users. However in almost every case, it's still better than both sides of the connection being unsecured. I'm not sure what this has to do with all CDNs being MITM operators when caching secure content.
- gkop 10y agoAt the very least, Cloudflare should do a better job of discouraging use of Flexible SSL. People that opt in to Flexible SSL should know what they are doing. I edited my comment.
- nilved 10y agoWhich is precisely why you should not use an MITM network.
- manigandham 10y agoWhat precisely? I don't see a counter-argument. If you're saying not to use any CDNs then that's not very reasonable considering the service that CDNs provide.
- nilved 10y agoThe benefit of CDNs is increasingly questionable, but you can still realize them by managing it yourself. What I'm saying is to never use a third-party network that subverts your own security. I would try harder to nail that point in, but I don't think Cloudflare's coffin has room for any more.
- manigandham 10y agoQuestionable? There is no shortcut for the speed of light, regardless of how optimized the HTTP and TLS protocol gets. Building your own CDN is no easy feat if you want the performance, security, scale and reliability that you get from a focused vendor. Everything on the internet is a product of thousands of vendors, hardware equipment and software components working together. There are millions of factors that can and may be compromised so the only realistic approach is risk management. It's far better to rely on a well funded, staffed and capable vendor rather than building your own version. This is solid advice for everything outside of the expertise of your business so I'm not sure why a CDN is anything different. Assess the risk and do what works for you.
- hueving 10y agoCloudflare is not a shortcut for the speed of light in this case. You load static assets/video streams/whatever from CDNs. Things that contain sensitive content like account pages, messages, etc should go directly to the server since that is exactly what cloudflare will do as well.