4 ms·

If your two servers communicate over the public internet rather than a private network, all you've done is made your users believe they are behind a secure conn

If your two servers communicate over the public internet rather than a private network, all you've done is made your users believe they are behind a secure connection when they really aren't. For example, if your "old" server is a colocated physical server and your proxy server is a fancy cloud VM.

swiley 6y ago
This is why the content should have been signed. IMO: https is actually overhyped, it solves some problems but has plenty of its own
Jonnax 6y ago
How old is the server for this scenario? If it can't run a modern web server as a proxy directly. Then maybe you could set up a VPN tunnel between the server and your fancy cloud VM. But running some ancient hardware not for historical reasons but taking user data, is wrong.
- adrianmonk 6y ago
  Or the hosting provider could offer a turnkey solution. They could use something like VLAN to isolate that physical server on its own network, put the VLAN behind a firewall, and have an HTTPS reverse proxy that goes through that firewall. Depending on how their network is built, it might even be possible to make this self-service where you enable a setting in your account and your physical server gets wrapped in this additional layer.
danShumway 6y ago
> all you've done Eh. I sort of disagree with this specific phrasing. People shouldn't focus only on targeted attacks on the server. Of course if you have an HTTPS proxy in front of an HTTP server, you can be MITMed between those two servers, and that's very bad. But even with that flaw you're getting benefits. Public networks can't inject malware/ads into that webpage, a MITM attacker between your proxy and the main server will have a harder time correlating a request with a specific person, ISPs will have a harder time scanning the traffic for use with ads/metadata. This is a similar argument that comes up sometimes about VPNs. I know people who argue that a VPN does nothing because it just moves trust from one party to another. But the reality is that if you search my public IP address, you will get a pretty decent approximation of where I live. In a world without a VPN, I'm not just choosing whether or not I trust my ISP, I'm choosing whether I'm comfortable giving a decent marker of my physical location to literally every single website that I visit. That doesn't mean the "moving trust" concern isn't valid, it just means it's not the full picture of what a VPN (either privately hosted or through a 3rd-party) protects you from. In the same way, it is a valid concern that behind the scenes data might not be encrypted between a proxy and a server. But that's not the full picture of what HTTPS protects you from. HTTPS also protects you at the router/network level.

swiley 6y ago

This is why the content should have been signed. IMO: https is actually overhyped, it solves some problems but has plenty of its own

Jonnax 6y ago

How old is the server for this scenario? If it can't run a modern web server as a proxy directly. Then maybe you could set up a VPN tunnel between the server and your fancy cloud VM. But running some ancient hardware not for historical reasons but taking user data, is wrong.

adrianmonk 6y ago
Or the hosting provider could offer a turnkey solution. They could use something like VLAN to isolate that physical server on its own network, put the VLAN behind a firewall, and have an HTTPS reverse proxy that goes through that firewall. Depending on how their network is built, it might even be possible to make this self-service where you enable a setting in your account and your physical server gets wrapped in this additional layer.

danShumway 6y ago

> all you've done Eh. I sort of disagree with this specific phrasing. People shouldn't focus only on targeted attacks on the server. Of course if you have an HTTPS proxy in front of an HTTP server, you can be MITMed between those two servers, and that's very bad. But even with that flaw you're getting benefits. Public networks can't inject malware/ads into that webpage, a MITM attacker between your proxy and the main server will have a harder time correlating a request with a specific person, ISPs will have a harder time scanning the traffic for use with ads/metadata. This is a similar argument that comes up sometimes about VPNs. I know people who argue that a VPN does nothing because it just moves trust from one party to another. But the reality is that if you search my public IP address, you will get a pretty decent approximation of where I live. In a world without a VPN, I'm not just choosing whether or not I trust my ISP, I'm choosing whether I'm comfortable giving a decent marker of my physical location to literally every single website that I visit. That doesn't mean the "moving trust" concern isn't valid, it just means it's not the full picture of what a VPN (either privately hosted or through a 3rd-party) protects you from. In the same way, it is a valid concern that behind the scenes data might not be encrypted between a proxy and a server. But that's not the full picture of what HTTPS protects you from. HTTPS also protects you at the router/network level.