3 ms·

Cloudflare's free SSL is not secure.

by thesmallestcat 9y ago

catshirt 9y ago
is not? or was not? honest question. care to elaborate for a noob?
- lambda 9y ago
  CloudFlare's "Flexible SSL" (https://www.cloudflare.com/ssl/ https://www.cloudflare.com/ssl/) offers encryption/authentication from CloudFlare's server to the client, but none from the origin server to CloudFlare's. Which means that is a vector by which the content could be sniffed or modified in transit. It's a "better than nothing" option, as there are a slightly higher number of actively exploited attack vectors that apply to the client to CDN connection than the CDN to origin server, such as "free" wifi that injects ads, malicious ISP DNS, and the like. But it's not actually secure, as the origin server to CDN connection could be tampered with, and just because there are fewer active attacks that would be likely to affect that connection right now, doesn't mean that someone won't come along later and hijack such a connection. CloudFlare offers other TLS options that do include encryption and authentication between the origin server and CDN, but they do require that you set up a certificate on your server, so if all you're trying to do is enable TLS (and don't care about the CDN), just installing a cert on the origin server and using TLS is probably a simpler option that using CloudFlare.
  - catshirt 9y ago
    great noob elaboration. much appreciated. :)
  - prdonahue 9y ago
    We encourage users to use Strict mode which requests and validates a certificate from the origin. It's great that shared web hosting providers and others are starting to make it easy to acquire and install a certificate, but that hasn't always been the case. EDIT: We also provide an API that will provision a free certificate for your origin: https://blog.cloudflare.com/cloudflare-ca-encryption-origin/ https://blog.cloudflare.com/cloudflare-ca-encryption-origin/. The certificate is optimized for communication with our edge (essentially just as small a chain as possible, as we don't need the intermediate to walk to the root). Either that or use certbot from EFF/Let's Encrypt.
- deleted 9y ago
  [deleted]
- justboxing 9y ago
  > is not? or was not? Troy Hunt (OP) discusses this at length in this post => CloudFlare, SSL and unhealthy security absolutism https://www.troyhunt.com/cloudflare-ssl-and-unhealthy-security-absolutism/ https://www.troyhunt.com/cloudflare-ssl-and-unhealthy-securi...
milankragujevic 9y ago
Well it kind of is if you setup a self-signed SSL cert on your server and use Full SSL (not strict).
- blfr 9y ago
  You can setup a Let's Encrypt certificate on your server and use Full SSL (strict). It will also make switching away from Cloudflare in the future easier.
  - jgrahamc 9y ago
    That's right. Cloudflare doesn't try to lock people in with artificial constraints. Use Let's Encrypt for your origin. Very soon we hope to support Let's Encrypt completely for our main certs (once they have wildcard support).
deleted 9y ago
[deleted]

Cloudflare's free SSL is not secure.

catshirt 9y ago

is not? or was not? honest question. care to elaborate for a noob?

lambda 9y ago
CloudFlare's "Flexible SSL" (https://www.cloudflare.com/ssl/ https://www.cloudflare.com/ssl/) offers encryption/authentication from CloudFlare's server to the client, but none from the origin server to CloudFlare's. Which means that is a vector by which the content could be sniffed or modified in transit. It's a "better than nothing" option, as there are a slightly higher number of actively exploited attack vectors that apply to the client to CDN connection than the CDN to origin server, such as "free" wifi that injects ads, malicious ISP DNS, and the like. But it's not actually secure, as the origin server to CDN connection could be tampered with, and just because there are fewer active attacks that would be likely to affect that connection right now, doesn't mean that someone won't come along later and hijack such a connection. CloudFlare offers other TLS options that do include encryption and authentication between the origin server and CDN, but they do require that you set up a certificate on your server, so if all you're trying to do is enable TLS (and don't care about the CDN), just installing a cert on the origin server and using TLS is probably a simpler option that using CloudFlare.
- catshirt 9y ago
  great noob elaboration. much appreciated. :)
- prdonahue 9y ago
  We encourage users to use Strict mode which requests and validates a certificate from the origin. It's great that shared web hosting providers and others are starting to make it easy to acquire and install a certificate, but that hasn't always been the case. EDIT: We also provide an API that will provision a free certificate for your origin: https://blog.cloudflare.com/cloudflare-ca-encryption-origin/ https://blog.cloudflare.com/cloudflare-ca-encryption-origin/. The certificate is optimized for communication with our edge (essentially just as small a chain as possible, as we don't need the intermediate to walk to the root). Either that or use certbot from EFF/Let's Encrypt.
deleted 9y ago
[deleted]
justboxing 9y ago
> is not? or was not? Troy Hunt (OP) discusses this at length in this post => CloudFlare, SSL and unhealthy security absolutism https://www.troyhunt.com/cloudflare-ssl-and-unhealthy-security-absolutism/ https://www.troyhunt.com/cloudflare-ssl-and-unhealthy-securi...

milankragujevic 9y ago

Well it kind of is if you setup a self-signed SSL cert on your server and use Full SSL (not strict).

blfr 9y ago
You can setup a Let's Encrypt certificate on your server and use Full SSL (strict). It will also make switching away from Cloudflare in the future easier.
- jgrahamc 9y ago
  That's right. Cloudflare doesn't try to lock people in with artificial constraints. Use Let's Encrypt for your origin. Very soon we hope to support Let's Encrypt completely for our main certs (once they have wildcard support).

deleted 9y ago

[deleted]