Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Universal SSL

blog.cloudflare.com

Post reply on HN
Print view View original

121–130 of 250 posts

Re: Universal SSL

#121

Post by peterwwillis »

logn wrote: post #33
vader1 wrote: post #23

I have very mixed feelings about this. Yes, on the one hand this is great news because a lot of websites who otherwise never would have bothered with SSL can now be protected from snooping or traffic manipulation on your local (possibly very insecure: your neighborhood Starbucks' wifi) network. On the other hand, this completely destroys the premise of HTTPS that you have an encrypted connection to the website you ar…

What they should do is require that the server has at least a self-signed certificate. They already support that but don't require it.

What good would that do? A self-signed cert is about as secure as no cert at all. (Unless they implement their own form of certificate pinning for the origin, which would cause problems for sites with multiple certs on the same host, which is quite common)

Re: Universal SSL

#122

Post by ancarda »

Once IPv6 is a bit more popular, will CloudFlare use a unique IP per customer to get around SNI or will it still be used on IPv6? It seems a bit like NAT; something that can safely die once IPv4 is gone.

Re: Universal SSL

#123

Post by nknighthb »

nirvdrum wrote: post #42
nknighthb wrote: post #13

Earlier quoted context omitted.

If your target audience is in the west, it's more like 5-10%, and the problem there is going away. XP and Android 2.x are dropping off pretty quickly.

The larger problem I had was with non-interactive browsers. E.g., GitHub changed their downloads server to use SNI and overnight a bunch of scripts I had using wget on Ubuntu 12.04 (a distribution supported until 2017) stopped working. Java 6 doesn't support SNI, so you need to watch your API stats. And I seem to recall using versions of Python and Ruby that also didn't support it.

I wonder if Canonical could be talked into getting an SNI-enabled wget into 12.04. Though if it were me, my response would probably just be "use curl" (which does work in 12.04.

I don't know what the status is in Ruby. Python 3 supports SNI natively. Python 2.x does not with the included libraries, but can be made to. (You're shooting yourself in the foot by using Python 2.x's included libraries with HTTPS anyway -- it doesn't verify certificates. Oops.)

Re: Universal SSL

#124

Post by moe »

vader1 wrote: post #23

I have very mixed feelings about this. Yes, on the one hand this is great news because a lot of websites who otherwise never would have bothered with SSL can now be protected from snooping or traffic manipulation on your local (possibly very insecure: your neighborhood Starbucks' wifi) network. On the other hand, this completely destroys the premise of HTTPS that you have an encrypted connection to the website you ar…

seeing the padlock will only tell you

Seeing the padlock has never told you much interesting to begin with.

You have to click the padlock and compare the fingerprint to a known good one.

Yes, nobody does that. And that's why SSL in the browser is a red herring (as far as 3-letter agencies are concerned).

Why no browser vendor ever tried to fix this basic design flaw is left as an exercise to the reader.

Re: Universal SSL

#125

Post by dsr_ »

corobo wrote: post #110
dsr_ wrote: post #16

CloudFlare now has the most sophisticated MITM attack in the world, where they tell you what they are doing and make you sign up for it. Does CloudFlare have a direct pipe to the NSA already, or is that only going to happen next week?

Your tinfoil's got a hole in it there buddy! But also https://www.cloudflare.com/transparency Could probs do with being a bit closer to realtime but it's more transparent than most hosts/ISPs

CloudFlare has never installed any law enforcement software or equipment anywhere on our network.

CloudFlare has never provided any law enforcement organization a feed of our customers' content transiting our network.

which is all great, except that the NSA is not a law-enforcement organization. It's an intelligence agency.

Re: Universal SSL

#127

Post by sarciszewski »

MCRed wrote: post #114
scintill76 wrote: post #45

Earlier quoted context omitted.

The centralization argument still has merit. If this catches on big time, there's only one company to coerce/compromise, to backdoor a bunch of services at once. Arguably the CA/ISP structure is like this already, but this may be worse.

Totally true, but on the other hand, the first mile will be encrypted for a lot more connections: "Yesterday, there were about 2 million sites active on the Internet that supported encrypted connections. By the end of the day today, we'll have doubled that." That's kind of spectacular. I think the first mile is one of the key places where data gets stolen. OF course the final millimeters-on the server- is another.

Yes, but this (free SSL everywhere) can (and should!) become the bandwagon that all other service/hosting providers and CAs should adopt.

Re: Universal SSL

#128

Post by snewman »

ancarda wrote: post #122

Once IPv6 is a bit more popular, will CloudFlare use a unique IP per customer to get around SNI or will it still be used on IPv6? It seems a bit like NAT; something that can safely die once IPv4 is gone.

According to the article, they are already doing that.

Re: Universal SSL

#129

Post by neurobro »

vader1 wrote: post #23

I have very mixed feelings about this. Yes, on the one hand this is great news because a lot of websites who otherwise never would have bothered with SSL can now be protected from snooping or traffic manipulation on your local (possibly very insecure: your neighborhood Starbucks' wifi) network. On the other hand, this completely destroys the premise of HTTPS that you have an encrypted connection to the website you ar…

Assuming I understand what they're offering here, I'd consider something like this for self-hosting a Facebook game having no valuable data, as Facebook requires apps to use SSL, and users tend to shy away from bright red browser windows with dire warnings about untrusted security certificates.

Re: Universal SSL

#130

Post by sah2ed »

mattmanser wrote: post #71
buro9 wrote: post #39

Earlier quoted context omitted.

> this completely destroys the premise of HTTPS that you have an encrypted connection to the website you are visiting It does nothing of the kind, it has always been the case that seeing the SSL padlock only informed you that the connection to whichever server you are communicating with is encrypted and nothing more. Do you not recall the age of customer feedback pages hosted behind SSL that actually just sent plain…

5 years ago most sites didn't even bother to SSL a lot of their pages and then firesheep came along to show us all how much of a security hole that was. Harking back to "Oh, but we used to do X back in the day" is a really silly thing to say. Do you still string concat your SQL variables perhaps? The Snowdon revelations showed that the NSA were happily hoovering up all our plaintext emails because the tech companies…

> Gordon Brown brokered the deal with jgrahamc to sell out personal privacy for a pardon for Turing (joke!)

For some background on this, see http://en.wikipedia.org/wiki/Alan_Turing#Government_apology_...

Post reply on HN