4 ms·
I know nothing of https. I put my sites on free cloudflare and i get https without having to do anything, is that enough or?
by popotamonga 8y ago
I know nothing of https.
I put my sites on free cloudflare and i get https without having to do anything, is that enough or?
- r1ch 8y agoUnfortunately not. If you aren't setting up HTTPS at your origin then the connection still goes unencrypted over the internet. Full (Strict) is the only secure SSL option at Cloudflare.
- leni536 8y agoNote that the "Flexible SSL" and even the "Full SSL" options don't protect the traffic between your server and Cloudflare. You you need to enable "Full SSL (strict)" as your SSL setting for that.
- Maakuth 8y agoHowever, he is getting quite a sizable portion of all the security benefits on HTTPS even with the current setup. I think it's quite a bit better than plaintext http all the way. Troy Hunt has written well about this: https://www.troyhunt.com/cloudflare-ssl-and-unhealthy-security-absolutism/ https://www.troyhunt.com/cloudflare-ssl-and-unhealthy-securi...
- r1ch 8y agoYou get a few benefits (protection against local interception) but it comes with a significant downside as it takes away the ability for an end user to identify if the connection is actually secure. For example I wouldn't enter my card details or other personal info on a HTTP site, but when CF is in front of it, I have no way of knowing if that's strict HTTPS to the origin or if most of the connection goes insecurely over the internet. The other problem is that CF makes it very easy for less technical website owners to click a button, see a green lock and assume everything is fine.