3 ms·

Sorry, I just chose cloudflare as a random example when speculating, I don't have any information about what specific providers this would affect, and I'm not i

by terom 9y ago

Sorry, I just chose cloudflare as a random example when speculating, I don't have any information about what specific providers this would affect, and I'm not implying that cloudflare would be affected. Seems like my guess was right, though!

jgrahamc 9y ago
No, need to apologize. When you say "Seems like my guess was right, though!" are you saying that there is some way that Cloudflare is involved? EDIT: I see (https://community.letsencrypt.org/t/2018-01-09-issue-with-tls-sni-01-and-shared-hosting-infrastructure/49996 https://community.letsencrypt.org/t/2018-01-09-issue-with-tl...) now. I don't think LE has been in contact with us so don't think we're affected but happy to be told otherwise.
- terom 9y ago
  I would indeed like to explicitly apologize, because I regret mentioning "cloudflare etc" as an example. That's exactly the kind of bad speculation that leads to harmful rumors based on misunderstandings. > When you say "Seems like my guess was right, though!" are you saying that there is some way that Cloudflare is involved? No. It seems like I was right about the general nature of the vulnerability. It remains to be seen what providers are affected. That being said, at this point, I'd personally be happier seeing a list of providers NOT affected, rather than a list of affected providers... It's probably also in "major public CDN provider's" interest to demonstrate that their user cert validation processes would have prevented this attack, and their customers were not at risk before LE pulled the plug...
puddums 9y ago
One of the requirements listed [1] as being needed for exposure to this for the provider is: Users have the ability to upload certificates for arbitrary names without proving domain control. When you say you were right, are you saying Cloudflare allows that? [1] https://community.letsencrypt.org/t/2018-01-09-issue-with-tls-sni-01-and-shared-hosting-infrastructure/49996 https://community.letsencrypt.org/t/2018-01-09-issue-with-tl...

by terom 9y ago

jgrahamc 9y ago

No, need to apologize. When you say "Seems like my guess was right, though!" are you saying that there is some way that Cloudflare is involved? EDIT: I see (https://community.letsencrypt.org/t/2018-01-09-issue-with-tls-sni-01-and-shared-hosting-infrastructure/49996 https://community.letsencrypt.org/t/2018-01-09-issue-with-tl...) now. I don't think LE has been in contact with us so don't think we're affected but happy to be told otherwise.

terom 9y ago
I would indeed like to explicitly apologize, because I regret mentioning "cloudflare etc" as an example. That's exactly the kind of bad speculation that leads to harmful rumors based on misunderstandings. > When you say "Seems like my guess was right, though!" are you saying that there is some way that Cloudflare is involved? No. It seems like I was right about the general nature of the vulnerability. It remains to be seen what providers are affected. That being said, at this point, I'd personally be happier seeing a list of providers NOT affected, rather than a list of affected providers... It's probably also in "major public CDN provider's" interest to demonstrate that their user cert validation processes would have prevented this attack, and their customers were not at risk before LE pulled the plug...

puddums 9y ago

One of the requirements listed [1] as being needed for exposure to this for the provider is: Users have the ability to upload certificates for arbitrary names without proving domain control. When you say you were right, are you saying Cloudflare allows that? [1] https://community.letsencrypt.org/t/2018-01-09-issue-with-tls-sni-01-and-shared-hosting-infrastructure/49996 https://community.letsencrypt.org/t/2018-01-09-issue-with-tl...