201–210 of 250 posts
Good job cloudflare for finally keeping up with the industry. Cloudfront, for example, already supports universal ssl and SNI
We've offered SSL for 4 years now. This is entirely different. Cloudfront, for example, doesn't give you SSL for free.
Earlier quoted context omitted.
The centralization argument still has merit. If this catches on big time, there's only one company to coerce/compromise, to backdoor a bunch of services at once. Arguably the CA/ISP structure is like this already, but this may be worse.
Hasn't this been the case with people using SSL on Amazon's ELB?
Earlier quoted context omitted.
Can you elaborate on what the attack on Full SSL would be? If you give CF your self signed certificate over a private secure channel, why isn't that still secure?
That would be secure. What they do is not secure. You never send them your public key, they simply try to connect to you take _any_ self-signed public key without performing any verification, allowing trivial MITM between them and your web server. I would love to be wrong here, but please show me where you upload your public key. Last time I used full SSL at least there was no such option. No upload of public key or…
Earlier quoted context omitted.
Browser makers and others have been trying to fix this, it is actually harder than it looks. HSTS, certificate transparency, and shipping pre-pinned certs with the browser are all approaches pushed forward by browser makers. As an example of how this is harder than it looks one need only look to DNSSEC.
pushed forward by browser makers Huh? Which browser alerts me when the cert changes from the previous one that it has seen for a site? That would be the most basic and trivial mitigation for a start. What we see instead is consortium paralysis for decades . Occam's razor much? HSTS does nothing for certificate trust. And the other two you mentioned still conveniently keep us at the mercy of browser vendors and infras…
This alone would make self-signing much more viable for many uses.
Interestingly, I just tried to visit one of my CloudFlare protected sites. Shoving https in front of the URL results in this error in Firefox & Chrome. dabr.eu uses an invalid security certificate. The certificate is only valid for the following names: ssl2000.cloudflare.com, .redpitt.mobi, redpitt.mobi, cloudflare.com, .cloudflare.com So I assume it isn't quite as seamless / automated as it makes out? edit ah - a li…
Your cert hasn't been issued yet. We are in the processing of issuing 2 million certs. You got a default cert that's sort of a 'catch all'. When that goes away your domain will have been issued a real cert.
Earlier quoted context omitted.
>> "On the other hand, this completely destroys the premise of HTTPS that you have an encrypted connection to the website you are visiting." >> Yes, you do. You are visiting a website that CloudFlare is serving, and you have encryption to that. Total newbie here. Since CloudFlare (and likewise any other CDN) is hosting many websites, how do I know the information served originated from the intended website and not fr…
"how do I know the information served originated from the intended website and not from another one CloudFlare is hosting?" You don't, really. The target website has indicated that they trust CloudFlare, and if CloudFlare turns out to be unworthy of that trust you're pretty much out of luck. From SSL's point of view it is exactly the same as if the originating party is unworthy of your trust. I think there's a bit of…
Incidentally, I've never come across this term geas. http://en.wiktionary.org/wiki/geas
(Gaelic mythology) A vow or obligation placed upon a person.
A curse.
A mystical compulsion.This is silly. SSL is supposed to be a secure conversation between the website and the end user. No one else is between. Encouraging these things is detrimental to internet. In fact, I would go ahead and say: * Make browser self-signed certs less scarier * Make users more accustomed and knowledgable of self-signed certs. Browser vendors and corporations need to work together to make the above happen.
Earlier quoted context omitted.
That would be secure. What they do is not secure. You never send them your public key, they simply try to connect to you take _any_ self-signed public key without performing any verification, allowing trivial MITM between them and your web server. I would love to be wrong here, but please show me where you upload your public key. Last time I used full SSL at least there was no such option. No upload of public key or…
Ah. I haven't used the interface, and just made an assumption of how I thought would work (which I assume others may have as well). That does sound insecure.
Really hope they get there soon. Secure self-signed SSL to CF then free CA signed SSL to the internet would make this whole free thing a lot better.
Earlier quoted context omitted.
So long as CF pins the cert it's perfectly safe.
Like I said in my comment, yes, pinning the cert would be better. It wouldn't be PKI at that point, but it would be better than just accepting any self-signed cert. But what is 'safe'? What are you actually trying to secure? If you're trying to ensure that CloudFlare receives an authentic copy of data to deliver to users, a pinned self-signed cert will do that. If you're trying to also ensure that only the intended p…
Earlier quoted context omitted.
Browser makers and others have been trying to fix this, it is actually harder than it looks. HSTS, certificate transparency, and shipping pre-pinned certs with the browser are all approaches pushed forward by browser makers. As an example of how this is harder than it looks one need only look to DNSSEC.
pushed forward by browser makers Huh? Which browser alerts me when the cert changes from the previous one that it has seen for a site? That would be the most basic and trivial mitigation for a start. What we see instead is consortium paralysis for decades . Occam's razor much? HSTS does nothing for certificate trust. And the other two you mentioned still conveniently keep us at the mercy of browser vendors and infras…