3 ms·
Another implication of this result is: even if the transport layer security appears to be secure, it's possible that it only indicates the CDN setup, and the ac
by segfaultbuserr 7y ago
Another implication of this result is: even if the transport layer security appears to be secure, it's possible that it only indicates the CDN setup, and the actual upstream servers are insecure.
Which means, a latest and greatest TLSv1.3 server you see may be ultimately backed by a vulnerable TLSv1.0 upstream server (or even unencrypted HTTP!).
Great news for the NSA indeed!
- Jestar342 7y agoDisclaimer: Asking from a place of ignorance/naivity What does this mean for SSL termination? E.g. SSL terminates at cloudflare, internal (behind firewall) all http-sans-s?
- jdfellow 7y agoMy gut says that such a thing is a bad idea and TLS for internal communications is best practice. Hard to implement though.
- newman314 7y agoHard to implement but I’m slowly dragging org teama into it.
- psychrometer 7y agoThat depends on whether that site has Flexible or Full SSL setting enabled. https://support.cloudflare.com/hc/en-us/articles/200170416-End-to-end-HTTPS-with-Cloudflare-Part-3-SSL-options https://support.cloudflare.com/hc/en-us/articles/200170416-E...