3 ms·

I haven't seen anything on our internal security mailing lists about this. If it does somehow involve Cloudflare I'd be happy to receive a report directly via H

I haven't seen anything on our internal security mailing lists about this. If it does somehow involve Cloudflare I'd be happy to receive a report directly via HackerOne (https://hackerone.com/cloudflare https://hackerone.com/cloudflare). Happy to assist.

terom 9y ago
Sorry, I just chose cloudflare as a random example when speculating, I don't have any information about what specific providers this would affect, and I'm not implying that cloudflare would be affected. Seems like my guess was right, though!
- jgrahamc 9y ago
  No, need to apologize. When you say "Seems like my guess was right, though!" are you saying that there is some way that Cloudflare is involved? EDIT: I see (https://community.letsencrypt.org/t/2018-01-09-issue-with-tls-sni-01-and-shared-hosting-infrastructure/49996 https://community.letsencrypt.org/t/2018-01-09-issue-with-tl...) now. I don't think LE has been in contact with us so don't think we're affected but happy to be told otherwise.
  - terom 9y ago
    I would indeed like to explicitly apologize, because I regret mentioning "cloudflare etc" as an example. That's exactly the kind of bad speculation that leads to harmful rumors based on misunderstandings. > When you say "Seems like my guess was right, though!" are you saying that there is some way that Cloudflare is involved? No. It seems like I was right about the general nature of the vulnerability. It remains to be seen what providers are affected. That being said, at this point, I'd personally be happier seeing a list of providers NOT affected, rather than a list of affected providers... It's probably also in "major public CDN provider's" interest to demonstrate that their user cert validation processes would have prevented this attack, and their customers were not at risk before LE pulled the plug...
- puddums 9y ago
  One of the requirements listed [1] as being needed for exposure to this for the provider is: Users have the ability to upload certificates for arbitrary names without proving domain control. When you say you were right, are you saying Cloudflare allows that? [1] https://community.letsencrypt.org/t/2018-01-09-issue-with-tls-sni-01-and-shared-hosting-infrastructure/49996 https://community.letsencrypt.org/t/2018-01-09-issue-with-tl...
discreditable 9y ago
I don't think CF is affected because TLS-SNI-01 has never worked for cf-proxied sites (I've tried). CF doesn't allow clients to use invalid certificates for domains they don't own, which is key for the tls-sni-01 process.

terom 9y ago

Sorry, I just chose cloudflare as a random example when speculating, I don't have any information about what specific providers this would affect, and I'm not implying that cloudflare would be affected. Seems like my guess was right, though!

jgrahamc 9y ago
No, need to apologize. When you say "Seems like my guess was right, though!" are you saying that there is some way that Cloudflare is involved? EDIT: I see (https://community.letsencrypt.org/t/2018-01-09-issue-with-tls-sni-01-and-shared-hosting-infrastructure/49996 https://community.letsencrypt.org/t/2018-01-09-issue-with-tl...) now. I don't think LE has been in contact with us so don't think we're affected but happy to be told otherwise.
- terom 9y ago
  I would indeed like to explicitly apologize, because I regret mentioning "cloudflare etc" as an example. That's exactly the kind of bad speculation that leads to harmful rumors based on misunderstandings. > When you say "Seems like my guess was right, though!" are you saying that there is some way that Cloudflare is involved? No. It seems like I was right about the general nature of the vulnerability. It remains to be seen what providers are affected. That being said, at this point, I'd personally be happier seeing a list of providers NOT affected, rather than a list of affected providers... It's probably also in "major public CDN provider's" interest to demonstrate that their user cert validation processes would have prevented this attack, and their customers were not at risk before LE pulled the plug...
puddums 9y ago
One of the requirements listed [1] as being needed for exposure to this for the provider is: Users have the ability to upload certificates for arbitrary names without proving domain control. When you say you were right, are you saying Cloudflare allows that? [1] https://community.letsencrypt.org/t/2018-01-09-issue-with-tls-sni-01-and-shared-hosting-infrastructure/49996 https://community.letsencrypt.org/t/2018-01-09-issue-with-tl...

discreditable 9y ago

I don't think CF is affected because TLS-SNI-01 has never worked for cf-proxied sites (I've tried). CF doesn't allow clients to use invalid certificates for domains they don't own, which is key for the tls-sni-01 process.