Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Universal SSL

blog.cloudflare.com

Post reply on HN
Print view View original

241–250 of 250 posts

Re: Universal SSL

#241

Post by cs6034 »

dsr_ wrote: post #16

CloudFlare now has the most sophisticated MITM attack in the world, where they tell you what they are doing and make you sign up for it. Does CloudFlare have a direct pipe to the NSA already, or is that only going to happen next week?

Actually this does have some merit. Cloud Flare once protected Lulzsec servers. The FBI likely established their relationship with CF during this time to monitor all network activity to/from Lulzsec sites. Now Cloud Flare is the #1 ddos protection service for all sorts of shady sites, all those script kiddies on Hackforums, and everybody else the FBI would like to keep tabs on. CF's response to protecting booter services and the like is they don't discriminate against customers and remain a so-called neutral party. It would be a goldmine for the FBI to have one US based service with full traffic monitoring of all these persons of interest. A TLS gateway would be an even bigger goldmine.

They claim they have never done this but have to comply with warrants and NSLs being US based. Hard to believe the FBI never requested anything from CF back when Lulzsec had dedicated agents after them. They would be incompetent if they didn't get data out of CF to help their investigation.

Re: Universal SSL

#242

Post by notastartup »

kijin wrote: post #240
notastartup wrote: post #238

so how does this differ from the paid plan? I mean the only reason I am paying is because of SSL and now it's free?

The SSL on free plans is only compatible with newer clients. The SSL on paid plans is compatible with all clients, such as IE on XP, Android 2.x, and slightly outdated HTTP wrappers for most programming languages.

will the ssl be available on Chrome 37? by newer clients what versions of browser exactly?

Re: Universal SSL

#243

Post by kijin »

notastartup wrote: post #242
kijin wrote: post #240

Earlier quoted context omitted.

The SSL on free plans is only compatible with newer clients. The SSL on paid plans is compatible with all clients, such as IE on XP, Android 2.x, and slightly outdated HTTP wrappers for most programming languages.

will the ssl be available on Chrome 37? by newer clients what versions of browser exactly?

https://www.cloudflare.com/ssl#browsers

Re: Universal SSL

#244

Post by peterwwillis »

X-Istence wrote: post #230
peterwwillis wrote: post #222

Earlier quoted context omitted.

Yes, you could get the data going to and from the clients, which is most of the important user data. The big problem is when your SSL/http/whatever is being terminated on the app server itself, exposing things like database access, SANs, etc.

No, it wouldn't expose those things. It would only expose things that OpenSSL itself had allocated/deallocated in that single process due to the way it was saving memory allocations for later re-use...

You're right. I meant in the case of a code execution exploit in the openssl layer, those things would be exposed if they were all on the same host/network.

Re: Universal SSL

#245

Post by jessaustin »

flaviu2 wrote: post #217
tekacs wrote: post #213

Earlier quoted context omitted.

Firefox + self-signed certs forces you to add an exception for the site, which makes the cert work and shouts at you again if that cert ever changes, so fulfilling the above. :)

Sure, but that is only helpful if you remember that the site had previously worked before. Otherwise, it's just like your first time visiting it.

Yes it would be nice if the browser prompted more suspicion in those cases when a self-signed cert changes than when one is simply used for the first time. (Theoretically the changing of a regular CA-signed cert shouldn't prompt any suspicion, but I wonder...)

Re: Universal SSL

#246

Post by chrisdone »

pdkl95 wrote: post #100
jgrahamc wrote: post #85

Earlier quoted context omitted.

It seems to me that CloudFlare is positioning themselves as another Google or Facebook, where a key feature of their business is that they get to track the web history of a large portion of internet users. CloudFlare's business model is not offering a free service and figure out how to make money. It's getting people to pay us money and those people are our actual customers who run web sites: https://www.cloudflare.c…

I get that stuff - their transparency report is, of course, also very encouraging and another boost to their reputation. (I'll mention that they have more "warrant canaries" than I was aware of previously, which IS a good sign, though the utility of such statements is somewhat uncertain) My concern is that the single point of failure still exists. CloudFlare may have the best of intentions, but they aren't going to b…

Yes, transparency reports don't mean anything to me. Just because a company says "we're good guys, seriously, look at some numbers", are we to be so impressed?

The flaw is not the company's actions, but the user's misplaced trust in a separate, private entity with their data.

Re: Universal SSL

#247

Post by psykovsky »

JoshTriplett wrote: post #194
psykovsky wrote: post #169

Earlier quoted context omitted.

So, you want NAT to die, but apparently you forget that NAT is what protects most domestic computers from intrusion, not anti-virus or software firewalls. It will be fun...

That use of NAT can trivially be replaced by an everything-out nothing-in firewall.

You expect technologically illiterate people to magically be able to protect themselves when they couldn't before?

Re: Universal SSL

#248

Post by psykovsky »

krallja wrote: post #180
psykovsky wrote: post #164

Earlier quoted context omitted.

Not trying to diminish the value of what you're doing, but, who gave you(Cloudflare) permission to issue SSL certificates for my domains, hypothetically speaking ofcourse? Shouldn't that be an opt-in process?

You did, when you delegated your domain to Cloudflare.

No, I didn't. I only gave them permission to act as nameservers for my domain(s). I don't even route my traffic trough cloudflare.

Re: Universal SSL

#249

Post by Sami_Lehtinen »

rictic wrote: post #185
moe wrote: post #124

Earlier quoted context omitted.

seeing the padlock will only tell you Seeing the padlock has never told you much interesting to begin with. You have to click the padlock and compare the fingerprint to a known good one. Yes, nobody does that. And that's why SSL in the browser is a red herring (as far as 3-letter agencies are concerned). Why no browser vendor ever tried to fix this basic design flaw is left as an exercise to the reader.

Browser makers and others have been trying to fix this, it is actually harder than it looks. HSTS, certificate transparency, and shipping pre-pinned certs with the browser are all approaches pushed forward by browser makers. As an example of how this is harder than it looks one need only look to DNSSEC.

CloudFlare could also provide DANE support.

Re: Universal SSL

#250

Post by fishywang »

jgrahamc wrote: post #99
edent wrote: post #98

Earlier quoted context omitted.

Faster man! Faster! :-) Thanks for doing this - such an excellent initiative.

Since you ask so nicely I had your domain bumped up in the queue.

After a week (or maybe a little earlier, I didn't check every day) I finally got my certifications. Thank you! But actually the https is broken because of mixed-content, caused by cloudflare.

My page declare css in relative path, like inc/style.css. Via cloudflare it becomes absolute http url, like http://mydomain.com/inc/A.style.css.pagespeed.cf.5Dzr782jVo.....

This won't work in https. You should change it to //, or better yet kept the relative path. Thanks.

Post reply on HN