2 ms·
> "First, TLS doesn't just guarantee confidentiality, it also provides authentication and guarantees the integrity of this page. That prevents an attacker on th
by alexbilbie 12y ago
> "First, TLS doesn't just guarantee confidentiality, it also provides authentication and guarantees the integrity of this page. That prevents an attacker on the network from serving you bogus content, and pretending like it's from me."
But it doesn't though. If (for example) you're using Cloudflare's free SSL then the SSL termination is at their servers and theres nothing stopping the them from mangling the page between the original server and them passing it on to you.
How do you actually know if you're connecting to the server and not some terminating load balancer and the connection is unencrypted from there to the server?
- rakoo 12y agoYou don't because that's how HTTPS is built: the client trusts whatever is sent its way as long as it's sent with a certificate that matches the domain. Said differently, the server trusts Cloudflare to distribute the content as expected, under its own name. This is _technically_ no different than you trusting a machine to run the correct code and return the correct page, whether it's at home or at your hosting provider. You as a website owner have to trust all those components to behave correctly, and Cloudflare is just another piece of it. Of course given the easiness with which Cloudflare can intercept the data (versus your hosting provider running some other code), the threat becomes palpable, but HTTPS can't give you anything here.