3 ms·
Full does not check certificates, so a MITM can supply any untrusted certificate and intercept your traffic. Only Full (Strict) does trusted cert checking.
by r1ch 5y ago
Full does not check certificates, so a MITM can supply any untrusted certificate and intercept your traffic. Only Full (Strict) does trusted cert checking.
- ewuhic 5y ago"Can" theoretically, or there's a valid attack vector which one may pull off immediately in the wild?
- captn3m0 5y agoThe current Airtel scenario is a good demonstration I’d say.
- r1ch 5y agoCloudflare terminates SSL at the point closest to the user, so any of the ISPs between Cloudflare's POP and the origin could MITM the traffic. Normally an untrusted MITM cert would throw up a TLS error, but since the Cloudflare <-> End User part is trusted, a MITM attack with anything but Full (Strict) is undetectable to an end user. There's plenty of examples of ISPs trying this in the wild: https://www.zdnet.com/article/kazakhstan-government-is-now-intercepting-all-https-traffic/ https://www.zdnet.com/article/kazakhstan-government-is-now-i... https://www.reddit.com/r/sysadmin/comments/4vy3op/my_isp_is_trying_to_intercept_some_of_my_https/ https://www.reddit.com/r/sysadmin/comments/4vy3op/my_isp_is_... https://superuser.com/questions/176651/isp-replaces-ssl-certificates-any-solution https://superuser.com/questions/176651/isp-replaces-ssl-cert...
- jrochkind1 5y agoHuh, I didn't realize Full didn't check certs at all. Why don't they have a mode that checks that the cert is valid for hostname that you have configured cloudflare to access (which *.s3.amazonaws.com already has), rather than for the end-point that the destination isn't actually answering on directly itself? Or maybe I'm misunderstanding what was up, have to mess with it more.