3 ms·

Could this or HTTPS Everywhere warn you when a site is known for encryption stripping? I think this happens on the free cloudflare tier and we can’t determine t

• ce4 6y ago
  How would you detect something like that? Thats at the discretion of the party running the webserver/service and it's not directly observable. Cloudflare acts as a reverse proxy in front of the real origin server (which uses https), but that affects really a lot of internet sites nowadays (Cloudflare, Akamai, aws/gcp/azure and so on). CDN-origin connectivity is also encrypted, afaik you cannot downgrade and strip ssl (at least not with Akamai)
• iso1631 6y ago
  All HTTPS does is ensure security between your client and the server with the private key of the certificate. You typically trust certificate signers (globalsign, letsencrypt, etc) who have their own policies for ensuring who gets a certificate (in LE's case you have to prove ownership of the domain) If a domain owner gets a certificate and gives it, and a private key, to a third party, then that's their business.
  • tetha 6y ago
    > All HTTPS does is ensure security between your client and the server with the private key of the certificate. Just for completeness, HTTPs does not necessarily guarantee you are connected to the right server. This depends on the CAs you trust. For example, larger enterprises commonly inject their own CA into their workstations in order to prevent loss of sensitive data. This allows SSL inspection proxies to terminate all SSL connections with a valid, trusted certificate from the perspective of that workstation. .