4 ms·

"Full SSL" is still useless against an advanced attacker as it does absolutely nothing to prevent MITM. Only "Strict SSL" does, which makes sure it's a valid C

"Full SSL" is still useless against an advanced attacker as it does absolutely nothing to prevent MITM. Only "Strict SSL" does, which makes sure it's a valid CA-signed certificate. What we need (and what myself and others have requested) is Full SSL with fingerprint checking so you can keep security with a self-signed cert. I honestly think CF should remove flexible SSL and full SSL as options - they're just too vulnerable to be valuable.

sbierwagen 12y ago
Or public key pinning: http://tools.ietf.org/html/draft-ietf-websec-key-pinning-19 http://tools.ietf.org/html/draft-ietf-websec-key-pinning-19
- ultramancool 12y ago
  Yeah, if they supported that and showed you the fingerprint of the pinned key it may be workable. My worry with that is that few of the smaller websites would bother to validate it. Pasting a fingerprint in removes the need.
eli 12y ago
Will Cloudflare take any self-signed certificate in that scenario? I assumed you'd have to confirm the fingerprint (essentially pinning it) from within Cloudflare interface.
- ultramancool 12y ago
  Currently in "Full SSL" mode they take any self-signed certificate. No fingerprint confirmation or even pinning. I use CF on multiple sites and generally love it, but this is one of their biggest shortcomings - I still need to buy certs if I don't want to get MITM'd.
yincrash 12y ago
Can you elaborate on what the attack on Full SSL would be? If you give CF your self signed certificate over a private secure channel, why isn't that still secure?
- ultramancool 12y ago
  That would be secure. What they do is not secure. You never send them your public key, they simply try to connect to you take _any_ self-signed public key without performing any verification, allowing trivial MITM between them and your web server. I would love to be wrong here, but please show me where you upload your public key. Last time I used full SSL at least there was no such option. No upload of public key or paste of fingerprint, they simply take anything your (or an attacker's) server provides on connection.
  - yincrash 12y ago
    Ah. I haven't used the interface, and just made an assumption of how I thought would work (which I assume others may have as well). That does sound insecure.
    - ultramancool 12y ago
      Yeah, they _finally_ added Strict SSL which validates it with a CA at least, but still no free option if you want actual security. Really hope they get there soon. Secure self-signed SSL to CF then free CA signed SSL to the internet would make this whole free thing a lot better.
meowface 12y ago
>"Full SSL" is still useless against an advanced attacker as it does absolutely nothing to prevent MITM. I wouldn't say this is entirely useless, even if there is still risk. Someone can impersonate your site to Cloudflare's reverse proxy server if they control the medium between, but they can't just get instant plaintext. This adds an additional barrier for an intruder into Cloudflare's network: they'd have to not only tap all traffic, but inject their own self-signed cert as well. This increases the chances of Cloudflare discovering the intrusion. I agree though that a pinning solution of some kind would be preferable.

sbierwagen 12y ago

Or public key pinning: http://tools.ietf.org/html/draft-ietf-websec-key-pinning-19 http://tools.ietf.org/html/draft-ietf-websec-key-pinning-19

ultramancool 12y ago
Yeah, if they supported that and showed you the fingerprint of the pinned key it may be workable. My worry with that is that few of the smaller websites would bother to validate it. Pasting a fingerprint in removes the need.

eli 12y ago

Will Cloudflare take any self-signed certificate in that scenario? I assumed you'd have to confirm the fingerprint (essentially pinning it) from within Cloudflare interface.

ultramancool 12y ago
Currently in "Full SSL" mode they take any self-signed certificate. No fingerprint confirmation or even pinning. I use CF on multiple sites and generally love it, but this is one of their biggest shortcomings - I still need to buy certs if I don't want to get MITM'd.

yincrash 12y ago

Can you elaborate on what the attack on Full SSL would be? If you give CF your self signed certificate over a private secure channel, why isn't that still secure?

ultramancool 12y ago
That would be secure. What they do is not secure. You never send them your public key, they simply try to connect to you take _any_ self-signed public key without performing any verification, allowing trivial MITM between them and your web server. I would love to be wrong here, but please show me where you upload your public key. Last time I used full SSL at least there was no such option. No upload of public key or paste of fingerprint, they simply take anything your (or an attacker's) server provides on connection.
- yincrash 12y ago
  Ah. I haven't used the interface, and just made an assumption of how I thought would work (which I assume others may have as well). That does sound insecure.
  - ultramancool 12y ago
    Yeah, they _finally_ added Strict SSL which validates it with a CA at least, but still no free option if you want actual security. Really hope they get there soon. Secure self-signed SSL to CF then free CA signed SSL to the internet would make this whole free thing a lot better.

meowface 12y ago

>"Full SSL" is still useless against an advanced attacker as it does absolutely nothing to prevent MITM. I wouldn't say this is entirely useless, even if there is still risk. Someone can impersonate your site to Cloudflare's reverse proxy server if they control the medium between, but they can't just get instant plaintext. This adds an additional barrier for an intruder into Cloudflare's network: they'd have to not only tap all traffic, but inject their own self-signed cert as well. This increases the chances of Cloudflare discovering the intrusion. I agree though that a pinning solution of some kind would be preferable.