Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Universal SSL

blog.cloudflare.com

Post reply on HN
Print view View original

151–160 of 250 posts

Re: Universal SSL

#151

Post by edent »

jgrahamc wrote: post #144
jgrahamc wrote: post #99

Earlier quoted context omitted.

Since you ask so nicely I had your domain bumped up in the queue.

And now... $ curl -v https://dabr.eu * Adding handle: conn: 0x7faa1c000000 * Adding handle: send: 0 * Adding handle: recv: 0 * Curl_addHandleToPipeline: length: 1 * - Conn 0 (0x7faa1c000000) send_pipe: 1, recv_pipe: 0 * About to connect() to dabr.eu port 443 (#0) * Trying 104.28.21.97... * Connected to dabr.eu (104.28.21.97) port 443 (#0) * TLS 1.2 connection using TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 * Server cer…

You guys rock :-)

Better start updating my servers so they don't redirect wildly.

Re: Universal SSL

#152

Post by pbreit »

jerf wrote: post #148
vader1 wrote: post #23

I have very mixed feelings about this. Yes, on the one hand this is great news because a lot of websites who otherwise never would have bothered with SSL can now be protected from snooping or traffic manipulation on your local (possibly very insecure: your neighborhood Starbucks' wifi) network. On the other hand, this completely destroys the premise of HTTPS that you have an encrypted connection to the website you ar…

"On the other hand, this completely destroys the premise of HTTPS that you have an encrypted connection to the website you are visiting ." Yes, you do. You are visiting a website that CloudFlare is serving, and you have encryption to that. Other replies have already gone into how HTTPS never guaranteed anything about what happened after that, but I think that's the wrong POV. What HTTPS guarantees is that one of the…

"https" has always implied that you are getting a secure connection between the browser and the origin server. I'm not sure how you can argue otherwise.

Re: Universal SSL

#153

Post by pbreit »

vader1 wrote: post #23

I have very mixed feelings about this. Yes, on the one hand this is great news because a lot of websites who otherwise never would have bothered with SSL can now be protected from snooping or traffic manipulation on your local (possibly very insecure: your neighborhood Starbucks' wifi) network. On the other hand, this completely destroys the premise of HTTPS that you have an encrypted connection to the website you ar…

Yeah, it strikes me as worse than no SSL since it creates a false impression of security. I'm surprised they are doing this.

Re: Universal SSL

#154

Post by pbreit »

josephwegner wrote: post #7
zaroth wrote: post #4

This is great, but just two concerns. CloudFlare just generated itself certs for how many domains? And you don't really have a secure connection but the browser will report that you do.

They do actually give you the ability to make this totally secure. They mentioned in the post that they will provide instructions on how to install a CloudFlare certificate on your server - this will allow CloudFlare to communicate securely with your server as it attempts to cache your content. Then when the user makes the request to CloudFlare, they return the content that they received over SSL, on an SSL connectio…

Since the vast majority of their customers will not implement the full loop, it seems the huge impact will be further confusing the implications of seeing "https" in the browser.

Re: Universal SSL

#155

Post by peterwwillis »

ceejayoz wrote: post #132
peterwwillis wrote: post #121

Earlier quoted context omitted.

What good would that do? A self-signed cert is about as secure as no cert at all. (Unless they implement their own form of certificate pinning for the origin, which would cause problems for sites with multiple certs on the same host, which is quite common)

> A self-signed cert is about as secure as no cert at all. It protects enormously against a casual attacker who is able to sniff network traffic but not MITM you.

This is the nail-clipper defense. For cases where a terrorist might take over a plane by threatening to give people tiny cuts or jabs, taking away nail clippers 'protects enormously'.

How often have you encountered read-only network access? It doesn't happen in reality; even the middle hop in a route has total control over the flow of traffic and thus can terminate it and mitm on reconnect. In any case, confidentiality is next to worthless without integrity and non-repudiation.

Re: Universal SSL

#156

Post by notdonspaulding »

vtlynch wrote: post #145
vader1 wrote: post #75

Earlier quoted context omitted.

Of course using HTTPS is no guarantee that the site doesn't leak your data in any other way. But never before has it been this easy to create a false sense of security: give the impression that connections to your site are encrypted, while in reality it's plaintext for half of the route. I think this will ultimately dilute the value of HTTPS as we know it, and can only hope that it will lead to the adoption of better…

I agree that this false sense of security is troubling. Many inexperienced site owners will think setting up Flexible SSL with Cloudflare is all they need to do. And it is unclear if the enduser has any way to see if the site they are connecting to is using Flexible or Full SSL. However, in the announcement Cloudflare did say: " Later today we'll be publishing a blog with instructions on how to do that at no cost. On…

> What I dont understand is how they will be doing this at no cost.

The same way that they're doing the first-mile encryption at no cost, by partnering with a CA that will sign certificates for free. StartSSL (http://www.startssl.com/) has been signing certs at no cost for years.

The marginal cost for a CA to sign an additional cert is negligible, particularly when there's no customer support involved (i.e. Cloudflare customers won't be calling Comodo or Globalsign's support numbers).

> It looks like the certificates being issued automatically are to "xxxxxx.cloudflare.com", and not to the origin domain.

Not having one in front of me, I can't say for sure, but they have to sign the cert for the origin domain or the browser wouldn't give you a padlock when you went to the origin domain. Certs may contain extended Subject Alternative Name fields that include other hostnames for which the cert should be considered valid. I'm guessing they're using something like this to add the origin domain alongside the xxxx.cloudflare.com domains. This is traditionally how you can have a single cert which works for both the root domain as well as the "www" version of the same (i.e. yourdomain.com and www.yourdomain.com use the exact same cert).

Re: Universal SSL

#157

Post by [deleted] »

vtlynch wrote: post #145
vader1 wrote: post #75

Earlier quoted context omitted.

Of course using HTTPS is no guarantee that the site doesn't leak your data in any other way. But never before has it been this easy to create a false sense of security: give the impression that connections to your site are encrypted, while in reality it's plaintext for half of the route. I think this will ultimately dilute the value of HTTPS as we know it, and can only hope that it will lead to the adoption of better…

I agree that this false sense of security is troubling. Many inexperienced site owners will think setting up Flexible SSL with Cloudflare is all they need to do. And it is unclear if the enduser has any way to see if the site they are connecting to is using Flexible or Full SSL. However, in the announcement Cloudflare did say: " Later today we'll be publishing a blog with instructions on how to do that at no cost. On…

[deleted]

Re: Universal SSL

#158

Post by tokenizerrr »

deanclatworthy wrote: post #93

I just got the popup, clicked "okay" and when I go to "Cloudflare settings", it's still only available to select SSL options for the paid plans. For those who haven't yet seen the popup there's a bit more info here: https://www.cloudflare.com/ssl#universal_ssl It's a pity that I got the message saying it was available on my account, when the setting is not yet activated :)

Just had the exact same experience, this is still great though. Looking forward to enabling SSL on my site (at no cost).

Re: Universal SSL

#159

Post by AlyssaRowan »

higherpurpose wrote: post #62

> These challenges required that, for free customers, we limit Universal SSL support to modern browsers. Modern browsers include support for ECDSA, where many legacy browsers do not. I hope in the (near) future, they'll enforce not using unsafe NIST curves for that, too. I don't think Internet Explorer supports Curve25519 or other safer curves right now, but it might in the future, and I hope they will make their mov…

There's a draft for X25519 (as the key exchange algorithm is named now) already. Future use for new curves has been referred to CFRG by the TLS working group for recommendations; Curve25519 is one of the lead contenders. Discussion is lively, that's about all I feel comfortable saying right now. :)

Re: Universal SSL

#160

Post by vtlynch »

notdonspaulding wrote: post #156
vtlynch wrote: post #145

Earlier quoted context omitted.

I agree that this false sense of security is troubling. Many inexperienced site owners will think setting up Flexible SSL with Cloudflare is all they need to do. And it is unclear if the enduser has any way to see if the site they are connecting to is using Flexible or Full SSL. However, in the announcement Cloudflare did say: " Later today we'll be publishing a blog with instructions on how to do that at no cost. On…

> What I dont understand is how they will be doing this at no cost. The same way that they're doing the first-mile encryption at no cost, by partnering with a CA that will sign certificates for free. StartSSL ( http://www.startssl.com/ ) has been signing certs at no cost for years. The marginal cost for a CA to sign an additional cert is negligible, particularly when there's no customer support involved (i.e. Cloudfl…

> Not having one in front of me, I can't say for sure, but they have to sign the cert for the origin domain or the browser wouldn't give you a padlock when you went to the origin domain.

Correct and under this scheme you wouldnt have a HTTPS connection with the origin site by default. The automatic configuration of Universal SSL is their "Flexible SSL" set up, where Cloudflare communicates with the origin server unsecured, but the connection between the client and Cloudflare is secured via a generic SSL issued to a subdomain at Cloudflare specific to each user account/domain.

If users tried to hit the site directly (such as when Cloudflare throws up those overload errors where you are able to circumvent their network) they would not get an encrypted connection.

If the customer then sets up a certificate on their own server then they will have a "Full SSL" connection, aka end-to-end encryption. The details on how this can be set up for free are forthcoming from Cloudflare.

There seems to be three ways of doing this: Their contact with Comodo/Globalsign also allows for more certificates issued directly to the origin domain; the origin domain will use a self-signed certificate which Cloudflare's network will trust (also will keep the origin domain reliant on Cloudflare to get trusted HTTPs); or they could be using StartSSL's free certs but given their partnership with Comodo/Globalsign this is unlikely.

Post reply on HN