3 ms·

> TLS doesn't handle e.g. man-in-the-middle tampering or replay attacks. In what way it doesn't?

by kaoD 1y ago

ezekg 1y ago
Take the biggest man-in-the-middle on the internet: Cloudflare. It terminates TLS and can modify requests or responses between client and server. Signatures prevent proxies, good and bad, from doing that without consequence.
- JambalayaJimbo 1y ago
  Correct me if I’m wrong here, but if you sign up for Cloudflare, you have to give it access to your private key in order for it to MITM you right?
  - acdha 1y ago
    The conspiratorial framing as scary-sounding “tampering” isn’t helping: it’s like describing a surgeon as someone who slices people. When you sign up for a CDN, you’re agreeing to have that company proxy your traffic so they can provide various features like caching, access control, edge-side includes or execution, security filtering, etc. which as a technical necessity require them to see your traffic to work. This is not unique to Cloudflare, for a CDN to do anything which involves seeing the payload you have to have a browser trusted key available to their nodes. Traditionally, you did this by giving them a browser-trusted x509 certificate and private key –now it’s common to authorize them to get one from a service like Let’s Encrypt-so they could handle the TLS handshake on any node for maximum performance but some CDNs like Cloudflare allow you to use your own key server so they don’t have access to the private key but do see the session key which gives you more control: https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-technical-details/ https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-tec... The other way this can work is by using the CDN at a lower level where it’s proxying TCP connections back to the origin servers. That loses a lot of performance and security features since they can’t see the traffic, which is why most people don’t use CDNs this way but it’s an option and it’s useful if you need to deal with custom protocols or things like accepting traffic on ports which Cloudflare doesn’t support for their normal proxy. If you really didn’t trust Cloudflare, you typically wouldn’t use them but if you had some kind of compliance requirement you could still use a CDN for things like better network performance and lower-level DDoS protection without giving the CDN operator visibility into your traffic payloads.

> TLS doesn't handle e.g. man-in-the-middle tampering or replay attacks. In what way it doesn't?

by kaoD 1y ago

> TLS doesn't handle e.g. man-in-the-middle tampering or replay attacks. In what way it doesn't?

Take the biggest man-in-the-middle on the internet: Cloudflare. It terminates TLS and can modify requests or responses between client and server. Signatures prevent proxies, good and bad, from doing that without consequence.

JambalayaJimbo 1y ago
Correct me if I’m wrong here, but if you sign up for Cloudflare, you have to give it access to your private key in order for it to MITM you right?
- acdha 1y ago
  The conspiratorial framing as scary-sounding “tampering” isn’t helping: it’s like describing a surgeon as someone who slices people. When you sign up for a CDN, you’re agreeing to have that company proxy your traffic so they can provide various features like caching, access control, edge-side includes or execution, security filtering, etc. which as a technical necessity require them to see your traffic to work. This is not unique to Cloudflare, for a CDN to do anything which involves seeing the payload you have to have a browser trusted key available to their nodes. Traditionally, you did this by giving them a browser-trusted x509 certificate and private key –now it’s common to authorize them to get one from a service like Let’s Encrypt-so they could handle the TLS handshake on any node for maximum performance but some CDNs like Cloudflare allow you to use your own key server so they don’t have access to the private key but do see the session key which gives you more control: https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-technical-details/ https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-tec... The other way this can work is by using the CDN at a lower level where it’s proxying TCP connections back to the origin servers. That loses a lot of performance and security features since they can’t see the traffic, which is why most people don’t use CDNs this way but it’s an option and it’s useful if you need to deal with custom protocols or things like accepting traffic on ports which Cloudflare doesn’t support for their normal proxy. If you really didn’t trust Cloudflare, you typically wouldn’t use them but if you had some kind of compliance requirement you could still use a CDN for things like better network performance and lower-level DDoS protection without giving the CDN operator visibility into your traffic payloads.