3 ms·

Have I got this right? Cloudflare serves an SSL certificate for each site that it MITMs, and they fail to revoke it when the site leaves Cloudflare. A site "le

Have I got this right? Cloudflare serves an SSL certificate for each site that it MITMs, and they fail to revoke it when the site leaves Cloudflare. A site "leaving" Cloudflare means that the site's DNS no longer points to Cloudflare IP addresses. What's the problem? The departing site stops serving the Cloudflare certificate. Cloudflare is no longer the destination for visitors to the site, so it won't be serving the certificate either. The only way it could abuse the retained certificate would be if it controlled the site's DNS, so if $SITE_OWNER changes DNS provider, the retained certificate isn't a problem. What did I miss?

vidarh 2y ago
That you're now one significantly weakened link closer to a breach. In itself this isn't a problem, but every time a provider thinks this isn't a problem because there needs to be other weaknesses elsewhere too, the validity of that logic is weakened.
lathiat 2y ago
You missed this line: “This is from a CDN who has a level of access unmatched by their rivals. CloudFlare are becoming the defualt DNS for browsers and have a VPN service.” They’ve got a pretty large vector for intercepting real traffic from a substantial number of users.
- bawolff 2y ago
  I mean, if that is the concern, maybe don't give them a cert in the first place.
  - 5e92cb50239222b 2y ago
    Lots of people use CloudFlare purely as a registar and DNS hoster because they sell domains at cost. Domains are quite expensive already for what they are. This is enough to trigger certificate issuance on your behalf. You don't have to use any add-on features. Maybe even just registering a domain is enough, I'm not sure. I certainly didn't "give them" any certificates, I don't have A/AAAA/CNAME records on several of my domains, and never enabled proxying traffic through the rest of them. The certs have been issued regardless. I don't see this as a conspiracy theory, though. They want to sell you the whole package and don't want to support freeloaders like me who are only there for the "cheap" domains. That's reasonable, if unfortunate.
deleted 2y ago
[deleted]
noname120 2y ago
He's just one DNS poisoning away from losing control of his website. Or a malicious DNS server used by a Wi-Fi network (e.g. public hotspots).
- remram 2y ago
  One DNS poisoning and cloudflare breach you mean?
  - noname120 2y ago
    Or one Cloudflare fuck-up. Either way, when I cut ties with a provider it's to cut ties with them, not leave them with a golden backdoor to my website.

vidarh 2y ago

That you're now one significantly weakened link closer to a breach. In itself this isn't a problem, but every time a provider thinks this isn't a problem because there needs to be other weaknesses elsewhere too, the validity of that logic is weakened.

lathiat 2y ago

You missed this line: “This is from a CDN who has a level of access unmatched by their rivals. CloudFlare are becoming the defualt DNS for browsers and have a VPN service.” They’ve got a pretty large vector for intercepting real traffic from a substantial number of users.

bawolff 2y ago
I mean, if that is the concern, maybe don't give them a cert in the first place.
- 5e92cb50239222b 2y ago
  Lots of people use CloudFlare purely as a registar and DNS hoster because they sell domains at cost. Domains are quite expensive already for what they are. This is enough to trigger certificate issuance on your behalf. You don't have to use any add-on features. Maybe even just registering a domain is enough, I'm not sure. I certainly didn't "give them" any certificates, I don't have A/AAAA/CNAME records on several of my domains, and never enabled proxying traffic through the rest of them. The certs have been issued regardless. I don't see this as a conspiracy theory, though. They want to sell you the whole package and don't want to support freeloaders like me who are only there for the "cheap" domains. That's reasonable, if unfortunate.

deleted 2y ago

[deleted]

noname120 2y ago

He's just one DNS poisoning away from losing control of his website. Or a malicious DNS server used by a Wi-Fi network (e.g. public hotspots).

remram 2y ago
One DNS poisoning and cloudflare breach you mean?
- noname120 2y ago
  Or one Cloudflare fuck-up. Either way, when I cut ties with a provider it's to cut ties with them, not leave them with a golden backdoor to my website.