4 ms·
Am I the only one alarmed with this sentence: “… when a client connects to Cloudflare to send HTTPS traffic, it first hits our TLS decryption proxy: it decrypts
by hm-nah 3y ago
Am I the only one alarmed with this sentence: “… when a client connects to Cloudflare to send HTTPS traffic, it first hits our TLS decryption proxy: it decrypts TLS traffic, processes HTTP 1, 2 or 3 traffic, then forwards it to our "business logic" proxy.”
- mannyv 3y agoAll non hipaa services decrypt at the edge. It's more efficient and easier to manage.
- hm-nah 3y agoI’m not a specialist in networking, but isn’t the only thing that should be decrypting TLS traffic, is the entity I’m sending data to or my browser?
- henry700 3y agoCloudflare doesn't cost money, you pay the price with your soul.
- charcircuit 3y agoThe entity you are sending data to is Cloudflare
- bewaretheirs 3y agoHTTP/2 multiplexing occurs inside the TLS boundary - there isn't a separate TLS stream for each sub-request. To demultiplex the requests you have to decrypt them first.
- thayne 3y agoThat's just how cloudflare works. It can't know what to cache, or use any rules based on the http request without decrypting the traffic. And without decrypting the request it can't do any application layer DDoS prevention. When you use cloudflare, or any other CDN, you either give them a certificate for your domain, or use DNS to allow them to acquire a certificate on your behalf.
- chrismorgan 3y agoWhat about it alarms you? Given the service they’re offering, what do you expect them to do instead?