4 ms·
read the sentence right above that: "We will establish a secure connection from the cloud to the site owner on your behalf for page requests of sites using SSL
by ryankshaw 15y ago
read the sentence right above that:
"We will establish a secure connection from the cloud to the site owner on your behalf for page requests of sites using SSL (e.g. https://example.com https://example.com)."
that means that the SSL is terminated at amazon's servers, they see it in plaintext, then they send it via SPDY (re-encrypted) to your device. so it is always secure over the wire, but is plaintext readable by amazon. if you are worried about what someone on the wire can see, you are good. if you are worried about what amazon can see, you're not.
- srdev 15y agoLet's not forget that this decryption and re-encryption[1] is going on in the AWS cloud, which is ostensibly shared infrastructure. Its not just what Amazon can see, but what other people who happen to be running on the boxes doing this re-encryption can see (through security vulnerabilities). [1] I'm making the assumption here that re-encryption is actually occurring. It could be the case that its not and the phrasing was simply poor.
- metamatt 15y agoYeah, that's what I find worrisome as well. And I don't see how it's possible for them to proxy SSL content without being MITM and re-encrypting. They could stay entirely out of the way for HTTPS requests, but if that's how they were doing it, I think their FAQ answer would just say so. If, on the other hand, they're inline enough to do the Silk acceleration thing at all, they have to be able to decrypt the traffic.