3 ms·

Not sure why all the negative reactions here... Was anyone else doing or providing this type of "Keyless SSL" setup? You'd think if this was a known technique,

Not sure why all the negative reactions here... Was anyone else doing or providing this type of "Keyless SSL" setup? You'd think if this was a known technique, the mentioned banks would already have been asking for it, implementing it, or doing it. Personally, I think CloudFlare is one of the few companies on here doing innovating stuff, and solving real issues. And if not - if they've pulled the wool over my eyes - then at least I can respect their marketing.

personZ 12y ago
You'd think if this was a known technique Isolating the key for security/control purposes is a well known technique. It's what ssh-agent/putty paegent does, where you can even forward key usage over the network to different machines. It's what PKCS11 does to SSL/TLS, where generally the key is a hardware security module (CAs and banks don't have keys sitting on their public facing machines, but instead generally have dedicated hardware for it -- they are generally doing, at a different scale, what is described), though there have been various implementations and proposals over the years to do it over the network (e.g. https://svn.opendnssec.org/docs/p11proxy.png https://svn.opendnssec.org/docs/p11proxy.png and pkcs11-proxy). Why isn't it commonly done as Rackspace proposes? Well it's kind of an odd need for limited gain, but is effectively PKCS11 used in a different context. If they are solving a specific need for some of their clients then fantastic, but it's the narrative of the innovation that makes it a bit weird, and yielded a lot of the purportedly negative commentary.
mentat 12y ago
PKCS11 and Hardware Security Modules (HSM) have been around for a long time. There's in wide use in companies like NetFlix and Square including "over the network". This is not new.

3 ms·

Not sure why all the negative reactions here... Was anyone else doing or providing this type of "Keyless SSL" setup? You'd think if this was a known technique,

by powertower 12y ago

personZ 12y ago
You'd think if this was a known technique Isolating the key for security/control purposes is a well known technique. It's what ssh-agent/putty paegent does, where you can even forward key usage over the network to different machines. It's what PKCS11 does to SSL/TLS, where generally the key is a hardware security module (CAs and banks don't have keys sitting on their public facing machines, but instead generally have dedicated hardware for it -- they are generally doing, at a different scale, what is described), though there have been various implementations and proposals over the years to do it over the network (e.g. https://svn.opendnssec.org/docs/p11proxy.png https://svn.opendnssec.org/docs/p11proxy.png and pkcs11-proxy). Why isn't it commonly done as Rackspace proposes? Well it's kind of an odd need for limited gain, but is effectively PKCS11 used in a different context. If they are solving a specific need for some of their clients then fantastic, but it's the narrative of the innovation that makes it a bit weird, and yielded a lot of the purportedly negative commentary.
mentat 12y ago
PKCS11 and Hardware Security Modules (HSM) have been around for a long time. There's in wide use in companies like NetFlix and Square including "over the network". This is not new.