3 ms·

Holy S*. I was about to call BS on you because I know CloudFlare supports end-to-end TLS then I read this: https://www.cloudflare.com/ssl https://www.cloudflar

by Rapzid 12y ago

Holy S*. I was about to call BS on you because I know CloudFlare supports end-to-end TLS then I read this: https://www.cloudflare.com/ssl https://www.cloudflare.com/ssl: > SSL can be difficult for website administrators to set up. > For sites that require more advanced SSL configurations, CloudFlare supports custom certificates from any certificate authority, full end-to-end SSL with robust certificate checking... Just, wow. TLS is NOT hard to setup for a website administrator. I think I just lost a ton of respect for CloudFlare. Granted, most threats would be between the client and CloudFlare anyway(that is to say, on the wrong side of the tracks), but still....

Animats 12y ago
Cloudflare offers a number of SSL options, but they all involve decrypting the traffic at Cloudflare and possibly re-encrypting it for the link to the final server. Their options: (https://www.cloudflare.com/ssl https://www.cloudflare.com/ssl) * "Flexible SSL" - encrypted from client to Cloudflare using Cloudflare's cert, unencrypted from Cloudflare to host. * "Full SSL" - encrypted from client to Cloudflare using Cloudflare's cert, encrypted from Cloudflare to host using a different host self-signed cert. * "Full SSL (strict)" - encrypted from client to Cloudflare using Cloudflare's cert, encrypted from Cloudflare to host using a different host CA-signed cert. (http://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-technical-details/ http://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-tech...) * "Keyless SSL" - encrypted from client to Cloudflare using the customer host's cert. Cloudflare doesn't have the customer's cert private key. They contact the customer's host for a session key for each session, and use this to encrypt from the client to Cloudflare. They decrypt at Cloudflare, and re-encrypt for the trip to the customer's host. With the first three, you can see in the browser that this is happening. The host will be identified as "cloudflare.com" in the certificate. With "Keyless SSL", which is basically MITM with active cooperation from the end host, it looks at the browser end like you're encrypted end to end, but you're not. One assumes that all of these are being "lawfully intercepted".
- Rapzid 12y ago
  The "possibly" is the problem. CloudFlare should not be promoting or supporting TLS that is not encrypted all the way to their customers infrastructure IMHO.
  - ryan-c 12y ago
    Cloudflare can't act as a "cloud waf" unless they are able to decrypt the ssl sessions.
    - Rapzid 12y ago
      The issue isn't that they are decrypting the traffic for inspection. That's a concession you just have to make with a trusted third party providing these types of services. The issue is that with their "Flexible SSL" they are then forwarding that unencrypted traffic on through the wilds(the internet) to the customer. Not only does this fly in the face of widely regarded best practices for transferring sensitive information between trusted, controlled networks the browser is none the wiser. You could argue that somebody with a certificate could do this anyhow. Yes, this is true. However CloudFlare who should, and most likely DOES, know better and are now doing this wholesale as a product offering! This should be frowned upon and CloudFlare should receive double frowns.
      - Animats 12y ago
        That's a concession you just have to make with a trusted third party providing these types of services. That's the problem. If you only use SSL/TLS for security-critical pages where there's a login or a credit card, you don't need some massive cloud-based service to cache your stuff. Many sites still use "transferring to secure site for shopping cart checkout". That's fine. If you use SSL/TLS for everything, now you have a load problem on the secure infrastructure. That's why "SSL Everywhere" is security theater. To have "security" on pages that don't need to be secure requires weakening security on the pages that do.
        nitrogen 12y ago
- IgorPartola 12y ago
  I wish that the Full SSL sans-strict option allowed me to upload my self-signed public key to CloudFlare. The problem is that CloudFlare can be MitM'ed without this step.
matthewmacleod 12y ago
Just, wow. TLS is NOT hard to setup for a website administrator. It really is – you might just be living in a bubble of competence! I've got years of experience as a developer and sysadmin, and I still sometimes struggle to get SSL working correctly on a site. Sure, getting and installing a cert is fine – but the mess of making sure that third-party services don't break, and that redirects aren't messed up, and that other virtual hosts don't break… it can be a time-consuming effort, and probably difficult for someone with less experience. Cloudflare have been pretty transparent with the service they're offering, so I find it hard to see this as a bad thing.
- icebraining 12y ago
  But how does FlexibleSSL help with the third-party services and redirects? Your site still appears as HTTPS, so those issues should still appear, no?
- topherTopher 12y ago
  Bubble of competence -- well put!
zubspace 12y ago
Setting up SSL is painful if it ain't your daily business. The problem is, that it could give users a false sense of security if their mom-and-pop webshop uses cloudflare ssl or if it uses unsecured cookies or an outdated protocol etc, etc... Regarding setting up SSL I'm reminded of this: https://news.ycombinator.com/item?id=8471877 https://news.ycombinator.com/item?id=8471877

by Rapzid 12y ago

Animats 12y ago

Cloudflare offers a number of SSL options, but they all involve decrypting the traffic at Cloudflare and possibly re-encrypting it for the link to the final server. Their options: (https://www.cloudflare.com/ssl https://www.cloudflare.com/ssl) * "Flexible SSL" - encrypted from client to Cloudflare using Cloudflare's cert, unencrypted from Cloudflare to host. * "Full SSL" - encrypted from client to Cloudflare using Cloudflare's cert, encrypted from Cloudflare to host using a different host self-signed cert. * "Full SSL (strict)" - encrypted from client to Cloudflare using Cloudflare's cert, encrypted from Cloudflare to host using a different host CA-signed cert. (http://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-technical-details/ http://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-tech...) * "Keyless SSL" - encrypted from client to Cloudflare using the customer host's cert. Cloudflare doesn't have the customer's cert private key. They contact the customer's host for a session key for each session, and use this to encrypt from the client to Cloudflare. They decrypt at Cloudflare, and re-encrypt for the trip to the customer's host. With the first three, you can see in the browser that this is happening. The host will be identified as "cloudflare.com" in the certificate. With "Keyless SSL", which is basically MITM with active cooperation from the end host, it looks at the browser end like you're encrypted end to end, but you're not. One assumes that all of these are being "lawfully intercepted".

Rapzid 12y ago
The "possibly" is the problem. CloudFlare should not be promoting or supporting TLS that is not encrypted all the way to their customers infrastructure IMHO.
- ryan-c 12y ago
  Cloudflare can't act as a "cloud waf" unless they are able to decrypt the ssl sessions.
  - Rapzid 12y ago
    The issue isn't that they are decrypting the traffic for inspection. That's a concession you just have to make with a trusted third party providing these types of services. The issue is that with their "Flexible SSL" they are then forwarding that unencrypted traffic on through the wilds(the internet) to the customer. Not only does this fly in the face of widely regarded best practices for transferring sensitive information between trusted, controlled networks the browser is none the wiser. You could argue that somebody with a certificate could do this anyhow. Yes, this is true. However CloudFlare who should, and most likely DOES, know better and are now doing this wholesale as a product offering! This should be frowned upon and CloudFlare should receive double frowns.
    - Animats 12y ago
      That's a concession you just have to make with a trusted third party providing these types of services. That's the problem. If you only use SSL/TLS for security-critical pages where there's a login or a credit card, you don't need some massive cloud-based service to cache your stuff. Many sites still use "transferring to secure site for shopping cart checkout". That's fine. If you use SSL/TLS for everything, now you have a load problem on the secure infrastructure. That's why "SSL Everywhere" is security theater. To have "security" on pages that don't need to be secure requires weakening security on the pages that do.
      - nitrogen 12y ago
IgorPartola 12y ago
I wish that the Full SSL sans-strict option allowed me to upload my self-signed public key to CloudFlare. The problem is that CloudFlare can be MitM'ed without this step.

matthewmacleod 12y ago

Just, wow. TLS is NOT hard to setup for a website administrator. It really is – you might just be living in a bubble of competence! I've got years of experience as a developer and sysadmin, and I still sometimes struggle to get SSL working correctly on a site. Sure, getting and installing a cert is fine – but the mess of making sure that third-party services don't break, and that redirects aren't messed up, and that other virtual hosts don't break… it can be a time-consuming effort, and probably difficult for someone with less experience. Cloudflare have been pretty transparent with the service they're offering, so I find it hard to see this as a bad thing.

icebraining 12y ago
But how does FlexibleSSL help with the third-party services and redirects? Your site still appears as HTTPS, so those issues should still appear, no?
topherTopher 12y ago
Bubble of competence -- well put!

zubspace 12y ago

Setting up SSL is painful if it ain't your daily business. The problem is, that it could give users a false sense of security if their mom-and-pop webshop uses cloudflare ssl or if it uses unsecured cookies or an outdated protocol etc, etc... Regarding setting up SSL I'm reminded of this: https://news.ycombinator.com/item?id=8471877 https://news.ycombinator.com/item?id=8471877