131–140 of 250 posts
Once IPv6 is a bit more popular, will CloudFlare use a unique IP per customer to get around SNI or will it still be used on IPv6? It seems a bit like NAT; something that can safely die once IPv4 is gone.
According to the article, they are already doing that.
Earlier quoted context omitted.
What they should do is require that the server has at least a self-signed certificate. They already support that but don't require it.
What good would that do? A self-signed cert is about as secure as no cert at all. (Unless they implement their own form of certificate pinning for the origin, which would cause problems for sites with multiple certs on the same host, which is quite common)
It protects enormously against a casual attacker who is able to sniff network traffic but not MITM you.
Earlier quoted context omitted.
> Could a third party sign up to cloudflare for a domain they do not own and somehow spoof the checks? You need to point the your domain to CloudFlare nameserver. I don't think you can do that unless you actually control the domain.
I guess you're right about that, but it still feels a bit weird that a third party can just allocate a private key and a valid certificate without the actual owner of the domain requesting it.
This is what makes me hesitant about using cloudflare or recommending it to clients; you give up a lot of control over your data and domains.
Earlier quoted context omitted.
What they should do is require that the server has at least a self-signed certificate. They already support that but don't require it.
What good would that do? A self-signed cert is about as secure as no cert at all. (Unless they implement their own form of certificate pinning for the origin, which would cause problems for sites with multiple certs on the same host, which is quite common)
Earlier quoted context omitted.
What they should do is require that the server has at least a self-signed certificate. They already support that but don't require it.
What good would that do? A self-signed cert is about as secure as no cert at all. (Unless they implement their own form of certificate pinning for the origin, which would cause problems for sites with multiple certs on the same host, which is quite common)
It's just probably too much effort for a small number of users who would go through the trouble. Or maybe not.
Earlier quoted context omitted.
It seems to me that CloudFlare is positioning themselves as another Google or Facebook, where a key feature of their business is that they get to track the web history of a large portion of internet users. CloudFlare's business model is not offering a free service and figure out how to make money. It's getting people to pay us money and those people are our actual customers who run web sites: https://www.cloudflare.c…
Do they have a Zero Knowledge policy or anything close to it, though? It doesn't matter if they don't make money from it, if they still collect all the data. I don't know how a service that's meant to cache data is supposed to be "zero knowledge", but hopefully they can do something about that - until it's too late and authorities already have a 1,000 requests lined up for their data.
Earlier quoted context omitted.
I think this is a good idea as well. In their blog post they discuss how "Full SSL" is much better security than "Flexible SSL", but by not making it a requirement a lot of people won't bother with it.
"Full SSL" is still useless against an advanced attacker as it does absolutely nothing to prevent MITM. Only "Strict SSL" does, which makes sure it's a valid CA-signed certificate. What we need (and what myself and others have requested) is Full SSL with fingerprint checking so you can keep security with a self-signed cert. I honestly think CF should remove flexible SSL and full SSL as options - they're just too vuln…
Earlier quoted context omitted.
Your tinfoil's got a hole in it there buddy! But also https://www.cloudflare.com/transparency Could probs do with being a bit closer to realtime but it's more transparent than most hosts/ISPs
CloudFlare has never installed any law enforcement software or equipment anywhere on our network. CloudFlare has never provided any law enforcement organization a feed of our customers' content transiting our network. which is all great, except that the NSA is not a law-enforcement organization. It's an intelligence agency.
That explains how they're able to do all of this for free accounts
Earlier quoted context omitted.
I hope so. But I'm still trying to figure out how. The only way I see they do it is that they check that the nameservers responsible for the domain actually points to cloudflares nameservers. This check doesn't seem to happen for http traffic, so it would be interesting to see how that works with https.
Not sure about cloudflare, as I never used them, but typically such services will ask you to create some subdomain (ie. cf1234.example.com).