4 ms·
Good angle. But we're not just talking about headquartered companies. Cloudflare has datacenters in Brisbane, Melbourne, Perth, and Sydney and an office in Sy
by kevin_b_er 8y ago
Good angle.
But we're not just talking about headquartered companies.
Cloudflare has datacenters in Brisbane, Melbourne, Perth, and Sydney and an office in Sydney. Could they be compelled to hand over your website's certificate that they have because they're the front end load balancing proxy for your website?? That way the police can man in the middle your website. Cloudflare would be gagged from telling you they gave away your private TLS certificate you entrusted them with.
- nybble41 8y agoSpin off Cloudflare Australia as an independent subcontractor of Cloudflare International. Give customers a choice of whether to enable Australian proxies for their site. Use distinct certificates for the proxies in each region, with short expiration times to limit the damage if a certificate falls into the wrong hands.
- komali2 8y agoMy understanding is an Australian cloudflare employee could be compelled to, yeah, hand over certificates, without telling their boss they did so.
- xucheng 8y agoBy this logic, there is no need to compel Cloudflare to handover the private TLS key. They can just compel any CA based in Australia to sign a fake cert. Or directly compelling OS vendors (Google, Apple, Microsoft,etc) to make government cert as a root CA.
- kevin_b_er 8y agoA fraudulently issued cert compelled by government might be detected by CA reporting. This was already done to watch for direct government controlled CAs issuing bad certs. Stealing your own existing cert is less likely to be detected.