3 ms·

It is very obvious... In hindsight?

powertower 12y ago
Not sure why all the negative reactions here... Was anyone else doing or providing this type of "Keyless SSL" setup? You'd think if this was a known technique, the mentioned banks would already have been asking for it, implementing it, or doing it. Personally, I think CloudFlare is one of the few companies on here doing innovating stuff, and solving real issues. And if not - if they've pulled the wool over my eyes - then at least I can respect their marketing.
- personZ 12y ago
  You'd think if this was a known technique Isolating the key for security/control purposes is a well known technique. It's what ssh-agent/putty paegent does, where you can even forward key usage over the network to different machines. It's what PKCS11 does to SSL/TLS, where generally the key is a hardware security module (CAs and banks don't have keys sitting on their public facing machines, but instead generally have dedicated hardware for it -- they are generally doing, at a different scale, what is described), though there have been various implementations and proposals over the years to do it over the network (e.g. https://svn.opendnssec.org/docs/p11proxy.png https://svn.opendnssec.org/docs/p11proxy.png and pkcs11-proxy). Why isn't it commonly done as Rackspace proposes? Well it's kind of an odd need for limited gain, but is effectively PKCS11 used in a different context. If they are solving a specific need for some of their clients then fantastic, but it's the narrative of the innovation that makes it a bit weird, and yielded a lot of the purportedly negative commentary.
- mentat 12y ago
  PKCS11 and Hardware Security Modules (HSM) have been around for a long time. There's in wide use in companies like NetFlix and Square including "over the network". This is not new.
buro9 12y ago
Sometimes the innovation is merely being able to rephrase the apparently impossible question into the one that has an obvious answer. It's worth remembering, no-one else was offering this or doing this... no-one else had phrased the problem such that the answer (even though it was known) became apparent.

Not sure why all the negative reactions here... Was anyone else doing or providing this type of "Keyless SSL" setup? You'd think if this was a known technique, the mentioned banks would already have been asking for it, implementing it, or doing it. Personally, I think CloudFlare is one of the few companies on here doing innovating stuff, and solving real issues. And if not - if they've pulled the wool over my eyes - then at least I can respect their marketing.

personZ 12y ago
You'd think if this was a known technique Isolating the key for security/control purposes is a well known technique. It's what ssh-agent/putty paegent does, where you can even forward key usage over the network to different machines. It's what PKCS11 does to SSL/TLS, where generally the key is a hardware security module (CAs and banks don't have keys sitting on their public facing machines, but instead generally have dedicated hardware for it -- they are generally doing, at a different scale, what is described), though there have been various implementations and proposals over the years to do it over the network (e.g. https://svn.opendnssec.org/docs/p11proxy.png https://svn.opendnssec.org/docs/p11proxy.png and pkcs11-proxy). Why isn't it commonly done as Rackspace proposes? Well it's kind of an odd need for limited gain, but is effectively PKCS11 used in a different context. If they are solving a specific need for some of their clients then fantastic, but it's the narrative of the innovation that makes it a bit weird, and yielded a lot of the purportedly negative commentary.
mentat 12y ago
PKCS11 and Hardware Security Modules (HSM) have been around for a long time. There's in wide use in companies like NetFlix and Square including "over the network". This is not new.

buro9 12y ago

Sometimes the innovation is merely being able to rephrase the apparently impossible question into the one that has an obvious answer. It's worth remembering, no-one else was offering this or doing this... no-one else had phrased the problem such that the answer (even though it was known) became apparent.