Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Universal SSL

blog.cloudflare.com

Post reply on HN
Print view View original

81–90 of 250 posts

Re: Universal SSL

#81

Post by pmh »

dividuum wrote: post #70
[deleted] wrote: post #65

Earlier quoted context omitted.

[deleted]

Understood. But how does that work in cloudflares case? Since they magically upgrade 2 million websites by the end of the day I cannot imagine all those sites have those verification files available.

Sorry, I deleted my comment since I thought the issue was better explained/covered downthread: https://news.ycombinator.com/item?id=8382419

As for spoofing the DNS record, I was under the impression that you switched your domain's nameservers to point at Cloudflare and that's what's used to verify that you control the domain.

Re: Universal SSL

#82

Post by unwind »

I just wonder how many actual physical human users those "99.44%" of the traffic from Antarctica represent. It's not exactly a population density hotspot, is it? :)

Juggling the number around a bit it seems to correspond to 1/179th, but Wikipedia says that the population of Antarctica varies with the season between 1,000 and 5,000.

Re: Universal SSL

#83

Post by nknighthb »

dividuum wrote: post #70
[deleted] wrote: post #65

Earlier quoted context omitted.

[deleted]

Understood. But how does that work in cloudflares case? Since they magically upgrade 2 million websites by the end of the day I cannot imagine all those sites have those verification files available.

Uh, CloudFlare controls all the traffic between your site and the world. They can automatically put whatever they want wherever they want on your site.

Re: Universal SSL

#84

Post by artursapek »

This is a very impressive achievement by CloudFront, but I wonder how many "this page includes other resources which are not secure" warnings I will notice today from websites that weren't prepared for this.

Re: Universal SSL

#85

Post by jgrahamc »

pdkl95 wrote: post #78

First, let me say that the aggressive approach to actually making encryption happen that CloudFlare has been pushing recently is very commendable. The hard part about finally retiring the old plaintext protocols we currently are stuck with is critical mass - nobody sees the point when plaintext seems to "work just fine". The various steps CloudFlare has taken to encourage SSL will go a long way towards reversing that…

It seems to me that CloudFlare is positioning themselves as another Google or Facebook, where a key feature of their business is that they get to track the web history of a large portion of internet users.

CloudFlare's business model is not offering a free service and figure out how to make money. It's getting people to pay us money and those people are our actual customers who run web sites: https://www.cloudflare.com/plans

Unfortunately, their motives don't matter - in a world where "national security letters" Prism, XKeyscore, and the like exist, CloudFlare's motives may not matter.

https://www.cloudflare.com/transparency

Re: Universal SSL

#86

Post by jgrahamc »

dividuum wrote: post #52

EDIT: Won't work: You need to verify that you own the domain by pointing your NS records to cloudflares nameservers. What prevents me from doing this MITM attack in (for example) a public wifi: I add a domain I don't own (example.com) to my cloudflare account. Then I point a hostname (www.example.com) to an IP address I own (1.2.3.4). From what I understand, cloudflare now serves HTTPS for this domain through their p…

This won't work because you don't control example.com. If you sign up for CloudFlare and tell us you do your site will be in an 'unverified' state until you move DNS to us. You won't be able to move DNS to us and so the CA process won't be able to issue a certificate.

Re: Universal SSL

#87

Post by dividuum »

jgrahamc wrote: post #86
dividuum wrote: post #52

EDIT: Won't work: You need to verify that you own the domain by pointing your NS records to cloudflares nameservers. What prevents me from doing this MITM attack in (for example) a public wifi: I add a domain I don't own (example.com) to my cloudflare account. Then I point a hostname (www.example.com) to an IP address I own (1.2.3.4). From what I understand, cloudflare now serves HTTPS for this domain through their p…

This won't work because you don't control example.com. If you sign up for CloudFlare and tell us you do your site will be in an 'unverified' state until you move DNS to us. You won't be able to move DNS to us and so the CA process won't be able to issue a certificate.

Thanks for the response. So this validation is required before you issue certificates? I was concerned there because non-https traffic seems to be able to use cloudflare before verification.

Re: Universal SSL

#88

Post by fiedzia »

dividuum wrote: post #76
fiedzia wrote: post #69

Earlier quoted context omitted.

I am pretty sure Cloudflare will verify that you are owner of the domain.

I hope so. But I'm still trying to figure out how. The only way I see they do it is that they check that the nameservers responsible for the domain actually points to cloudflares nameservers. This check doesn't seem to happen for http traffic, so it would be interesting to see how that works with https.

Not sure about cloudflare, as I never used them, but typically such services will ask you to create some subdomain (ie. cf1234.example.com).

Re: Universal SSL

#89

Post by zyx321 »

0x0 wrote: post #53
innocenat wrote: post #40

Earlier quoted context omitted.

> Could a third party sign up to cloudflare for a domain they do not own and somehow spoof the checks? You need to point the your domain to CloudFlare nameserver. I don't think you can do that unless you actually control the domain.

I guess you're right about that, but it still feels a bit weird that a third party can just allocate a private key and a valid certificate without the actual owner of the domain requesting it.

Yes, but that's an SSL "design flaw" that's been known literally for decades. Go take a look at your browser's trusted root certificates some time.

Everyone here likely knows on a cognitive level that SSL is pretty damn broken, but being reminded of the fact still feels rather disconcerting.

Re: Universal SSL

#90

Post by meowface »

logn wrote: post #33
vader1 wrote: post #23

I have very mixed feelings about this. Yes, on the one hand this is great news because a lot of websites who otherwise never would have bothered with SSL can now be protected from snooping or traffic manipulation on your local (possibly very insecure: your neighborhood Starbucks' wifi) network. On the other hand, this completely destroys the premise of HTTPS that you have an encrypted connection to the website you ar…

What they should do is require that the server has at least a self-signed certificate. They already support that but don't require it.

I think this is a good idea as well. In their blog post they discuss how "Full SSL" is much better security than "Flexible SSL", but by not making it a requirement a lot of people won't bother with it.
Post reply on HN