3 ms·
Can you elaborate on what the attack on Full SSL would be? If you give CF your self signed certificate over a private secure channel, why isn't that still secur
by yincrash 12y ago
Can you elaborate on what the attack on Full SSL would be? If you give CF your self signed certificate over a private secure channel, why isn't that still secure?
- ultramancool 12y agoThat would be secure. What they do is not secure. You never send them your public key, they simply try to connect to you take _any_ self-signed public key without performing any verification, allowing trivial MITM between them and your web server. I would love to be wrong here, but please show me where you upload your public key. Last time I used full SSL at least there was no such option. No upload of public key or paste of fingerprint, they simply take anything your (or an attacker's) server provides on connection.
- yincrash 12y agoAh. I haven't used the interface, and just made an assumption of how I thought would work (which I assume others may have as well). That does sound insecure.
- ultramancool 12y agoYeah, they _finally_ added Strict SSL which validates it with a CA at least, but still no free option if you want actual security. Really hope they get there soon. Secure self-signed SSL to CF then free CA signed SSL to the internet would make this whole free thing a lot better.