4 ms·

Couldn't the NSA start working with other ISPs than AT&T? I'd really like to see CDNs like CloudFlare start requiring Cloud <--> Origin encryption; e.g. what C

Couldn't the NSA start working with other ISPs than AT&T? I'd really like to see CDNs like CloudFlare start requiring Cloud <--> Origin encryption; e.g. what CloudFlare calls "Full SSL" -- https://support.cloudflare.com/hc/en-us/articles/200170416-What-do-the-SSL-options-mean- https://support.cloudflare.com/hc/en-us/articles/200170416-W.... Right now, you can do TLS termination ("Flexible SSL"), which end-users aren't aware of -- they see a padlock -- and I'm sure the NSA doesn't mind.

kodablah 8y ago
Sure they could, but one might hope the AT&T's eroded trust would serve as caution towards other overly cooperative companies. Or encourage companies to fight in court to be given the transparency allowances they desire to let the rest of us know they are legally compelled to do this and in no way do they agree or are doing anything beyond what's required. Granted, like FB issues and others, we in this community need to realize that most users simply don't care (even many b2b ones) and not get upset when our users don't move their dollars on principle. For us it's a big deal, for many there are real, harmful issues going on in the world and volume collection of data by companies and governments is not one of them. And we can't make it so despite the deluge of articles by a supportive mass media. EDIT: To clarify, you mentioned "other ISPs" but I want to be clear I'm talking about private pipes and not residential internet though I know they are often shared.
- enos 8y ago
  AT&T's cooperation with NSA has been public since 2004. It doesn't seem to have much of an effect on them.
hammock 8y ago
>Couldn't the NSA start working with other ISPs than AT&T? They do. They work with all of them. http://www.businessinsider.com/the-story-of-joseph-nacchio-and-the-nsa-2013-6 http://www.businessinsider.com/the-story-of-joseph-nacchio-a... AT&T just happens to have the oldest relationships and the largest infrastructure.
- deleted 8y ago
  [deleted]
syshum 8y ago
>Right now, you can do TLS termination ("Flexible SSL") Which sane people call Man in the Middle and should not be allowed at all. I have seen people doing this Flexiable SSL with Credit Card data and other PII believing it is "secure" Cloudflare may have started out with security in mind but their new services centered around centralization of key services (dns) and this kind of security breaking product means IMO they are a net negative in the world of Information Security
- jstarfish 8y ago
  It has its uses though, even if it's misused. It's an easy box to check to pretend to offer HTTPS so you don't get penalized by Google. Before Let's Encrypt there was no free way to get a legit cert for your cat blog. Faking it via Flexible SSL was the next best thing.
  - syshum 8y ago
    This is false, there have always been ways to get a free DV cert, lets encrypt made it easier Furhter before Lets Encrypt you would not have gotten dinged by google, Google only went that path when wide spread DV Certs where freely avaliable Further still, the minor costs per year to get a paid DV cert should be factor when choosing to host your own content versus paying a 3rd party to do it, many of those 3rd parties provided SSL as part of their services. There is zero need for a Man in the Middle for SSL,
- AgentME 8y ago
  Even Cloudflare's "Full SSL" mode is a man in the middle: Cloudflare is the man in the middle who sees the plaintext of connections going through them.

kodablah 8y ago

Sure they could, but one might hope the AT&T's eroded trust would serve as caution towards other overly cooperative companies. Or encourage companies to fight in court to be given the transparency allowances they desire to let the rest of us know they are legally compelled to do this and in no way do they agree or are doing anything beyond what's required. Granted, like FB issues and others, we in this community need to realize that most users simply don't care (even many b2b ones) and not get upset when our users don't move their dollars on principle. For us it's a big deal, for many there are real, harmful issues going on in the world and volume collection of data by companies and governments is not one of them. And we can't make it so despite the deluge of articles by a supportive mass media. EDIT: To clarify, you mentioned "other ISPs" but I want to be clear I'm talking about private pipes and not residential internet though I know they are often shared.

enos 8y ago
AT&T's cooperation with NSA has been public since 2004. It doesn't seem to have much of an effect on them.

hammock 8y ago

>Couldn't the NSA start working with other ISPs than AT&T? They do. They work with all of them. http://www.businessinsider.com/the-story-of-joseph-nacchio-and-the-nsa-2013-6 http://www.businessinsider.com/the-story-of-joseph-nacchio-a... AT&T just happens to have the oldest relationships and the largest infrastructure.

deleted 8y ago
[deleted]

syshum 8y ago

>Right now, you can do TLS termination ("Flexible SSL") Which sane people call Man in the Middle and should not be allowed at all. I have seen people doing this Flexiable SSL with Credit Card data and other PII believing it is "secure" Cloudflare may have started out with security in mind but their new services centered around centralization of key services (dns) and this kind of security breaking product means IMO they are a net negative in the world of Information Security

jstarfish 8y ago
It has its uses though, even if it's misused. It's an easy box to check to pretend to offer HTTPS so you don't get penalized by Google. Before Let's Encrypt there was no free way to get a legit cert for your cat blog. Faking it via Flexible SSL was the next best thing.
- syshum 8y ago
  This is false, there have always been ways to get a free DV cert, lets encrypt made it easier Furhter before Lets Encrypt you would not have gotten dinged by google, Google only went that path when wide spread DV Certs where freely avaliable Further still, the minor costs per year to get a paid DV cert should be factor when choosing to host your own content versus paying a 3rd party to do it, many of those 3rd parties provided SSL as part of their services. There is zero need for a Man in the Middle for SSL,
AgentME 8y ago
Even Cloudflare's "Full SSL" mode is a man in the middle: Cloudflare is the man in the middle who sees the plaintext of connections going through them.