11 ms·

They also allow for websites to look HTTPs-enabled, but the transfer happens in clear text, e.g.: Client -(HTTPS)> CloudFlare -(HTTP)> Server. For a compa

They also allow for websites to look HTTPs-enabled, but the transfer happens in clear text, e.g.: Client -(HTTPS)> CloudFlare -(HTTP)> Server. For a company that allegedly is privacy first, this is a huge violation of trust. I also know about some people that run websites that can't get Stripe because they can't figure out how to configure SSL for their website, they just plug in CloudFlare in front, and now they can communicate with Stripe, and everything is received in cleartext following the diagram i posted. Cloudflare calls this "Flexible SSL", and it is described here: https://support.cloudflare.com/hc/en-us/articles/200170416-What-do-the-SSL-options-mean- https://support.cloudflare.com/hc/en-us/articles/200170416-W... I have flagged this for both Cloudflare and Stripe, but none seems to care.

vimda 9y ago
The threat model of MiTM attacks leans heavily towards the client side than the Cloudflare -> origin connection. It's not perfect and it would be fantastic if everyone could setup SSL on their origin servers, but in the end there's are more script kiddies in coffeeshops than there are tier1 isps trying to steal your data
- syshum 9y ago
  Flexiable SSL by Cloudflare should itself be considered a MiTM Attack and should be opposed by all security standards, organizations, and anyone that values privacy or security, this highlights the inherent problem with SSL in the first place.