3 ms·

At a minimum I'd like cloudflare to mark such traffic in some way, and browsers to put a little cross through the "Https" indicator to show the traffic is passi

At a minimum I'd like cloudflare to mark such traffic in some way, and browsers to put a little cross through the "Https" indicator to show the traffic is passing unencrypted across the internet.

dspillett 18d ago
That is not a small “minimum”. There are places in the certificate format that a new flag can go, but then all browsers and apps that perform https requests need to be altered to display this in a manner that is: • consistent • not overly serious, so users who end up trained to ignore this new signal don't automatically ignore more significant warnings • (and this is the fun part) communicate this new semaphore signal to the general public without confusing them… To head off one cynical question: “Why worry about the general public when they wouldn't care anyway and just click through warnings with wreckless abandon already?” - if not the general public then who would this be for? Those who might need to care are already checking if their data is going through CF and so might not to under true E2EE.
- kawsper 17d ago
  They can just add an http header that browsers and browser plugins can listen for, they already add `cf-cache-status: HIT`, so they could add this too: cf-http-endpoint: 1 or if you want it to match their own terminology[0], it could be: cf-encryption-mode: off/flexible/full/full-strict/strict [0]: https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/ https://developers.cloudflare.com/ssl/origin-configuration/s...