5 ms·
Makes sense at a technical level, but the threat this is meant to mitigate (FB's servers/TLS certs get compromised and start serving you malicious JS scripts, a
by paxys 3y ago
Makes sense at a technical level, but the threat this is meant to mitigate (FB's servers/TLS certs get compromised and start serving you malicious JS scripts, a browser extension pings Cloudflare and sees that the hash is incorrect) is a little too far fetched. For example wouldn't the attacker also be able to update the expected hash on Cloudflare's side, considering they have already compromised FB's servers?
- quenix 3y agoWhy does compromising FB servers make compromising Cloudflare more likely?
- paxys 3y agoYou don't need to compromise Cloudflare, just tell them "this is the latest hash" while pretending to be FB.
- smileybarry 3y agoI assume this is meant for countries where ISPs/governments MITM traffic and force you to trust their CA. It’s possible the Cloudflare verification is HSTS-pinned, or perhaps it’s distrusting of TLS PKI and signs the hash in some way. (Or it’s just built that way because governments are more likely to MITM Meta services than CF at scale)