ZoneZealot

5 ms·

31.
by ZoneZealot 11mo ago
I agree, and I also am familiar with how WP Engine's 'GES' (global edge security) works. obr.uk points to two IP addresses held in the name of WP Engine, but they're actually BYOIP with Cloudflare. Cloudflare act as a ca
32.
by ZoneZealot 1y ago
You can even go all out with making custom enclosures, DIY Perks has some great videos on DIY audio. https://www.youtube.com/watch?v=XEspOD1NHr0&list=PLOJU8YJjFw...
33.
by ZoneZealot 1y ago
Cloudflare have only ever been able to do their job (on the reverse proxy CDN/WAF side), by doing full TLS interception. They see the session in plaintext. The customer grants Cloudflare a TLS certificate for their site either by uploa
34.
by ZoneZealot 1y ago
You're right, I was mistaken. Using a CNAME or A record as the only method to direct traffic at a label towards Cloudflare's reverse proxy is not available on the Free or Pro tier. https://developers.cloudflare.com&#x2F
35.
by ZoneZealot 1y ago
The trust we have in the CAs who are embedded in our root stores is very important - yes. Thankfully, in this case the issue at hand is entirely unrelated to TLS, rogue CAs etc. Or even DNS record manipulation (for now)... Cloudflare put a
36.
by ZoneZealot 1y ago
I tell it how it is :)
37.
by ZoneZealot 1y ago
I believe you're thinking of the domain registration side. If you want to use Cloudflare as your domain registrar, you must use their authoritative nameservers - unless you're on the enterprise plans. I don't use them for eit
38.
by ZoneZealot 1y ago
I thought their transparency report was quite clear https://www.cloudflare.com/en-gb/transparency/ > 5. Cloudflare has never modified the intended destination of DNS responses at the request of law enforcement
39.
by ZoneZealot 1y ago
>If you set cloudflare as your dns provider, they own the dns response they give you. If they get court ordered to redirect you to a site saying this is illegal. Is your preference for this to be over plaintext? Very important distinctio
40.
by ZoneZealot 1y ago
Note that the CA's that Cloudflare uses have not mis-issued any certificates in this case, the certificate was legitimately issued for Cloudflare to front the site in question with their CDN/WAF services. It just happens that the
41.
by ZoneZealot 1y ago
Cloudflare are not a public CA (see bottom), they use public CAs just like the rest of us. I'm sure they have special enterprise arrangements with each of them. Supported TLS certs via Cloudflare: https://developers.cloudfla
42.
by ZoneZealot 1y ago
> The screenshot clearly shows a valid HTTPS certificate, so either they don't do DNS blocking but instead implement the block on their loadbalancer side or they mis-issue HTTPS certificates. The former is only possible when the tar
43.
by ZoneZealot 1y ago
With public CAs, you can only apply for a wildcard at a single label. You can't have nested wildcards. RFC6125 limits wildcards to a left-most label (6.4.3. paragraph 2): https://www.rfc-editor.org/rfc/rfc6125.html
44.
by ZoneZealot 1y ago
It's 'driverhub.asus.com.example.com.' not 'driverhub.example.com.', therefore entirely discoverable in CT logs by searching for (regex): (driverhub|\*)\.asus\.com\.
45.
by ZoneZealot 1y ago
Parent comment is making a point that it might have been possible for an attacker to avoid discovery via certificate transparency logs, because anyone 'with a wildcard' could pull off the attack, which is not correct. I'm poi
46.
by ZoneZealot 1y ago
A wildcard certificate is only for a single label level, '*.example.com.' would not allow 'test.test.example.com.', but would allow 'test.example.com.'. If someone issued a wildcard for '*.asus.com.example