Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Announcing Keyless SSL

blog.cloudflare.com

Post reply on HN
Print view View original

121–130 of 190 posts

Re: Announcing Keyless SSL

#121

Post by ilaksh »

ilaksh wrote: post #83

This is a discussion about cyberwarfare in a literal sense. The technical discussion shouldn't really be separated from the economic, political, social and human health concerns because all of those parts of the system interact deeply and directly. A goal of total political cooperation or submission leads to economic sanctions leading to serious human health effects leading to defensive denial of service attacks. Thi…

Would be interested to hear from people who are burying my comment if they have any kind of explanation for why they are doing it, such as counterpoints to my statements. In case there is some insight that I might gain from them, since apparently there is a strong disagreement.

Re: Announcing Keyless SSL

#122

Post by diafygi »

xxdesmus wrote: post #112
sarciszewski wrote: post #77

Earlier quoted context omitted.

Is it related? ;)

not really -- only in that they are both SSL-related. Free SSL is still in the works. More info soon-ish.

I, for one, can't wait. StartCom desperately needs some competition.

My money is on AOL as the CA[1].

[1] http://moderncrypto.org/mail-archive/messaging/2014/000618.h...

Re: Announcing Keyless SSL

#123

Post by indutny »

peterwwillis wrote: post #117
haberman wrote: post #111

Earlier quoted context omitted.

No disrespect meant, but from a security perspective the idea of patching security-critical software with a patch from a stranger on the Internet is kind of crazy, isn't it?

All open source software is made up of patches from strangers on the internet.

Indeed :) On a serious note, I'm waiting for a reviewal from OpenSSL team.

Re: Announcing Keyless SSL

#124

Post by jldugger »

Mawaai wrote: post #53
personZ wrote: post #4

After reading the beginning of the piece, I was expected something more...profound. Some deep mathematical breakthrough or something. Instead they separate the actual key signing, delegating it to the customer's device. That's nice and useful, but isn't quite what I was expecting.

"Tomorrow, we'll publish a full post on the nitty, gritty techical details of how, what has come to be called Keyless SSL™, works."

But it's already fairly obvious how it works. They essentially MITM with the keyserver to receive the SSL nonce. Of course, it's pretty silly to expect cloudflare to have some special mathematical revolution to solve the stated problem. In fact I figure if you could terminate SSL without an online private key, the encryption scheme is simply broken.

Re: Announcing Keyless SSL

#125

Post by twistedpair »

peterwwillis wrote: post #117
haberman wrote: post #111

Earlier quoted context omitted.

No disrespect meant, but from a security perspective the idea of patching security-critical software with a patch from a stranger on the Internet is kind of crazy, isn't it?

All open source software is made up of patches from strangers on the internet.

I think I heard that quote on XKCD once.

Re: Announcing Keyless SSL

#126

Post by jtgeibel »

indutny wrote: post #19
blibble wrote: post #7

isn't this completely missing the point, i.e. banks being able to say 'no third parties can see our clients identifying information/balances/etc?' yes, the SSL key doesn't leave the bank, but everything it is protecting is..

It only protects one thing - server identity. The best ciphers do you use DHE for negotiating the key, so the conversation between bank and the client is secure anyway.

Under this scheme, the DHE is between the client and CloudFlare, not the client and the true end-point. CloudFlare still sees the full plaintext of the HTTPS session (as it must in order to do it's magic). The encryption is not end-to-end.

Re: Announcing Keyless SSL

#128

Post by jonknee »

flyt wrote: post #115
jonknee wrote: post #100

Earlier quoted context omitted.

As Google and Yahoo will tell you after they found out the US government broke into their dedicated lines between data centers... No. It must be encrypted at every transfer without exception.

There's a huge difference between passively tapping a fiber optic cable and infiltrating a network to inject malicious traffic. All we've ever seen evidence of is NSA's passive tapping of Google & others.

Wouldn't you want to prevent "passive" tapping? Passive in quotes because depending on what they find people will be killed, tortured, executed, kidnapped, arrested, etc. It's not passive when the NSA scoops up everyone's data and sends it to their spook friends around the world.

Re: Announcing Keyless SSL

#130

Post by haberman »

peterwwillis wrote: post #117
haberman wrote: post #111

Earlier quoted context omitted.

No disrespect meant, but from a security perspective the idea of patching security-critical software with a patch from a stranger on the Internet is kind of crazy, isn't it?

All open source software is made up of patches from strangers on the internet.

Not really. Gatekeepers of important open-source software are usually people who are known in the community and often employed by companies who work in the area.
Post reply on HN