5 ms·

We offer free origin certificates on any plan level (yes, including FREE). It's not 'really insecure' and you seem to imply that encryption costs more with Clou

We offer free origin certificates on any plan level (yes, including FREE). It's not 'really insecure' and you seem to imply that encryption costs more with Cloudflare. That's not true. https://blog.cloudflare.com/cloudflare-ca-encryption-origin/ https://blog.cloudflare.com/cloudflare-ca-encryption-origin/

Animats 10y ago
Your data is in the clear within Cloudflare, and may even be in the clear between Cloudflare and the real host if you choose that option. You're trusting Cloudflare's security and Cloudflare's internal certificate authority. Hundreds or thousands of sites would be compromised if Cloudflare had a security breach. Like the one they had three months ago.[1] [1] https://techcrunch.com/2017/02/23/major-cloudflare-bug-leaked-sensitive-data-from-customers-websites/ https://techcrunch.com/2017/02/23/major-cloudflare-bug-leake...
- jgrahamc 10y ago
  Data is only 'in the clear' inside a machine. All machine to machine communication in Cloudflare is encrypted with mutually authenticated TLS. If a user chooses to not encrypt the back haul from Cloudflare to their origin then, sure, that's not encrypted, but we offer free certificates for origin machines so there's no reason to use that option. If you don't like Cloudflare's Origin CA then use Let's Encrypt on the origin server.
  - aeronautic 10y ago
    Thanks so much for clarifying. We use your service - would recommend in a heartbeat.
  - daxorid 10y ago
    Even so, there's nothing preventing a LE or court order from compromising the confidentiality of your customers, no matter how hard you work on minimizing the scope of your cleartext domains. I know that you, Prince, rdl, and others are serious about security and privacy, but let's be honest here: If the Feds come a-knocking, you will comply. It's not that we don't trust you or your competence. You're just not immune to the jackboot threat model.
    - eastdakota 10y ago
      Actually, we'd fight like crazy legally — as we've demonstrated repeatedly and successfully — and have implemented our technical systems to make it difficult to reveal anything even if we were ordered to. Moreover, we've included warrant canaries in our Transparency Policy so you can know if anything has changed: https://www.cloudflare.com/transparency/ https://www.cloudflare.com/transparency/ See section "Some things we've never done."
      - maxerickson 10y ago
        Have you ever received a legal order not to change your warrant canaries? Have you ever received a legal order to not disclose that you have been ordered to not change your warrant canaries? And so on.
- corobo 10y ago
  > Your data is in the clear within Cloudflare Just a heads up you're telling Cloudflare's CTO how Cloudflare works
  - jgrahamc 10y ago
    You never know... I might learn something :-)
    - corobo 10y ago
      Oh for sure - I wasn't saying it to shut the conversation down, more to point out you're speaking with the knowledge of how the innards work :) I could have worded it to say that better but was dashing out of the house
  - viraptor 10y ago
    Just a heads up - it's the inventor of Nagle algorithm telling Cloudflare's CTO how Cloudflare works. This could be very interesting ;) (also stuff like that happens quite a lot on HN, I recommend using some user tagger extension)
    - corobo 10y ago
      Awesome, I love this site Yeah that would be super useful, so far I've been going by remembering usernames

Animats 10y ago

Your data is in the clear within Cloudflare, and may even be in the clear between Cloudflare and the real host if you choose that option. You're trusting Cloudflare's security and Cloudflare's internal certificate authority. Hundreds or thousands of sites would be compromised if Cloudflare had a security breach. Like the one they had three months ago.[1] [1] https://techcrunch.com/2017/02/23/major-cloudflare-bug-leaked-sensitive-data-from-customers-websites/ https://techcrunch.com/2017/02/23/major-cloudflare-bug-leake...

jgrahamc 10y ago
Data is only 'in the clear' inside a machine. All machine to machine communication in Cloudflare is encrypted with mutually authenticated TLS. If a user chooses to not encrypt the back haul from Cloudflare to their origin then, sure, that's not encrypted, but we offer free certificates for origin machines so there's no reason to use that option. If you don't like Cloudflare's Origin CA then use Let's Encrypt on the origin server.
- aeronautic 10y ago
  Thanks so much for clarifying. We use your service - would recommend in a heartbeat.
- daxorid 10y ago
  Even so, there's nothing preventing a LE or court order from compromising the confidentiality of your customers, no matter how hard you work on minimizing the scope of your cleartext domains. I know that you, Prince, rdl, and others are serious about security and privacy, but let's be honest here: If the Feds come a-knocking, you will comply. It's not that we don't trust you or your competence. You're just not immune to the jackboot threat model.
  - eastdakota 10y ago
    Actually, we'd fight like crazy legally — as we've demonstrated repeatedly and successfully — and have implemented our technical systems to make it difficult to reveal anything even if we were ordered to. Moreover, we've included warrant canaries in our Transparency Policy so you can know if anything has changed: https://www.cloudflare.com/transparency/ https://www.cloudflare.com/transparency/ See section "Some things we've never done."
    - maxerickson 10y ago
      Have you ever received a legal order not to change your warrant canaries? Have you ever received a legal order to not disclose that you have been ordered to not change your warrant canaries? And so on.
corobo 10y ago
> Your data is in the clear within Cloudflare Just a heads up you're telling Cloudflare's CTO how Cloudflare works
- jgrahamc 10y ago
  You never know... I might learn something :-)
  - corobo 10y ago
    Oh for sure - I wasn't saying it to shut the conversation down, more to point out you're speaking with the knowledge of how the innards work :) I could have worded it to say that better but was dashing out of the house
- viraptor 10y ago
  Just a heads up - it's the inventor of Nagle algorithm telling Cloudflare's CTO how Cloudflare works. This could be very interesting ;) (also stuff like that happens quite a lot on HN, I recommend using some user tagger extension)
  - corobo 10y ago
    Awesome, I love this site Yeah that would be super useful, so far I've been going by remembering usernames