7 ms·
A bit off topic, but I find it quite disheartening that cloudflare has regular blog posts about how great their security is and how safe you are with cloudflare
by r1ch 11y ago
A bit off topic, but I find it quite disheartening that cloudflare has regular blog posts about how great their security is and how safe you are with cloudflare, but at the same time offers customers seriously broken SSL options.
2 of the 3 options ("Universal SSL" and "Full SSL") are not "secure" by today's standards. Universal SSL leaves connections to the origin unsecured allowing for passive and active MITM attackers to intercept things. Full SSL allows an active MITM to intercept origin connections.
Advertising these services as "SSL" is misleading and offers a false sense of security to visitors as they will see the nice green SSL lock and think their connection to a cloudflare-protected website is fully protected. Meanwhile their credit card information and other personal details could be travelling over the internet in plain text to the origin.
- spacefight 11y agoYes. I have said it before and I say it again: Cloudflare (and any other large CDNs) are a perfect setup for a MITM or a perfect target for a nation-state's secret service.
- sschueller 11y agoEspecially when cloudflare is governed by the laws of the US which includes the patriot act. How do we know this isn't already the case?
- sarciszewski 11y agoIf your threat model includes intelligence agencies, set up your own HTTPS with HSTS and HPKP and don't use CloudFlare. Wow, that was easy.
- tikums 11y agoSo, basically anyone providing online services to customers then? Who's threat model should not include intelligence agencies? Online pet shop?
- sarciszewski 11y agoIt comes down to personal opinion more than anything.
- jgrahamc 11y agoUniversal SSL does not imply "origin unsecured": https://blog.cloudflare.com/universal-ssl-encryption-all-the-way-to-the-origin-for-free/ https://blog.cloudflare.com/universal-ssl-encryption-all-the...
- r1ch 11y agoIt seems I meant "Flexible SSL" instead of "Universal SSL". According to the main website, flexible SSL is not secured. https://www.cloudflare.com/ssl https://www.cloudflare.com/ssl The beta test of a Cloudflare CA for "Full SSL" is a big improvement over accepting any self-signed certificate, but I still think "Flexible SSL" should not be a thing.
- xyzzy123 11y agoIt misleads users, for a start. I get the business case (the whole point is that SSL is hard for a large class of server admins). Also it does help for e.g. users coming in via tor or un-trusted networks. But dammit, I still can't bring myself to like it.
- RpPr 11y agoNot to mention their disgraceful Tor captchas.
- jamespo 11y agoWhy do you think they have implemented these? Just to inconvenience you?
- lucb1e 11y ago(Another Tor browser user here.) Yes, it sure seems so. Half the time I visit Hacker News (which is behind Cloudflare) I have to fill in a captcha. I'm logged in with a 3k rep account and I'm not trying to do any action, I'm just trying to see the front page. That is surely suspicious enough to give me a captcha every ten minutes. Edit: to respond to both comments at once: alright Cloudflare may not recognize my HN cookie and account, but they do have two cf_* cookies, and I am merely loading the homepage. No weird URL parameters, no POST data, nothing.
- jamespo 11y agoAre you suggesting cloudflare should hook into HN to check your reputation, I'm not sure they have the engineering capacity to extend this to all sites.
- jtdowney 11y agoTo be fair, Cloudflare has no concept of how much reputation you have on HN.
- d23 11y agoDude, you're assuming that from that same exact IP address they aren't getting a ton of other traffic that isn't spamming the hell out of them or doing completely sketchy stuff. That's what happens when you share an IP address with other people -- especially those who might be criminals or have other nefarious motives for using tor.
- 11y ago