I presume that customer private keys need to be stored on Cloudflare servers to implement this. Has that just made Cloudflare servers a legitimate prime NSA target?
I.e. all your keys belong to us
CloudFlare enabling free SSL by mid-October
41–50 of 66 posts
Re: CloudFlare enabling free SSL by mid-October
#42Please note that using Cloudflare, even with free SSL, is not an increase to the security and privacy of your users. On the contrary, Cloudflare records information about your users (this cannot be disabled) and, by default, blocks users who attempt to view your site through privacy-enhancing software. I would suggest that people looking to install SSL on their website (this should be everybody) instead get their fre…
I assume you are referring to Tor? We love Tor and the specific things we block by default are resource consumption bots. If people enable. "I Am Under Attack" mode , I think there is some incidental interstitial challenge for Tor, but not blocked.
We don't comment on our customers unless they authorize us to, but based on the list of public ones, I would be pretty comfortable, even if I didn't work there.
Re: CloudFlare enabling free SSL by mid-October
#43I presume that customer private keys need to be stored on Cloudflare servers to implement this. Has that just made Cloudflare servers a legitimate prime NSA target? I.e. all your keys belong to us
We have a product, "keyless ssl", which is used by some customers to retain on premise custody of their asymmetric key material, actually.
Re: CloudFlare enabling free SSL by mid-October
#44Are there more actual implementation details somewhere? Sounds like selecting the ssl context based on the clients SNI request. This (obviously) would predicate client SNI support, as opposed to anycast IPs or similar.
CloudFlare's CEO says that free SSL will use SNI with ipv4 [1] and possibly non-SNI with ipv6 [2]. A CloudFlare engineer has discussed splitting the SSL handshake between servers so their many edge nodes don't need to keep customer secret keys in memory [3]. However, this sounds slightly different than the lazy loading behavior in the blog post. [1] https://news.ycombinator.com/item?id=7910849 [2] https://twitter.com…
Non-SNI over ipv6 seems pretty pointless since anything supporting ipv6 is going to have sni anyway.
Re: CloudFlare enabling free SSL by mid-October
#45Earlier quoted context omitted.
So, you're saying that using HTTP instead of HTTPS doesn't increase the privacy of users? I'd say that it does "increase" the privacy, although nobody is saying that it fixes every hole in the boat...
Speaking strictly, you're right, but when you consider (a) Cloudflare's connection to your server is insecure (b) Cloudflare is listening in on every request (c) Cloudflare blocks VPN and Tor users, it doesn't seem like such an obvious decision. But that's a false dichotomy, since everybody should use HTTPS, nobody should use HTTP, and, most importantly, nobody should be okay with third-parties snooping on your users…
Cloudflare's connection to your server is insecure
Re: CloudFlare enabling free SSL by mid-October
#46Earlier quoted context omitted.
Could you elaborate on this. My impression was that connections between data centres (e.g. in the case of using an EC2 instance with Cloudflare) were already very secure and therefore do not require SSL.
Depends what you're trying to protect against. Those links are notably very insecure against the NSA.
There is also the practical concern for NSA that cloudflare is a well resourced, highly motivated company who has publicly committed to protecting customer data. It would be a lot easier to push around a small company or non profit, especially a company which didn't have the resources or freedom to defend itself. It would certainly be possible to try to get a company like CloudFlare, Twitter, etc to bend to the NSA's will , but they know they are basically guaranteed a fight. Much safer to go to a smaller hosting provider or the end user organization or personnel themselves.
Re: CloudFlare enabling free SSL by mid-October
#47Earlier quoted context omitted.
Speaking strictly, you're right, but when you consider (a) Cloudflare's connection to your server is insecure (b) Cloudflare is listening in on every request (c) Cloudflare blocks VPN and Tor users, it doesn't seem like such an obvious decision. But that's a false dichotomy, since everybody should use HTTPS, nobody should use HTTP, and, most importantly, nobody should be okay with third-parties snooping on your users…
Cloudflare's connection to your server is insecure This isn't always the case. The connection can be secure.
Yeah, it can even be cert pinned, which is probably better than a non pinned end to end tls unless your attacker is local to you, due to the wonders of anycast. Also, like Google, we are constantly looking for malicious stuff like this on our IPs.
Re: CloudFlare enabling free SSL by mid-October
#48Earlier quoted context omitted.
CloudFlare's CEO says that free SSL will use SNI with ipv4 [1] and possibly non-SNI with ipv6 [2]. A CloudFlare engineer has discussed splitting the SSL handshake between servers so their many edge nodes don't need to keep customer secret keys in memory [3]. However, this sounds slightly different than the lazy loading behavior in the blog post. [1] https://news.ycombinator.com/item?id=7910849 [2] https://twitter.com…
Non-SNI over ipv6 seems pretty pointless since anything supporting ipv6 is going to have sni anyway.
Not true; Windows XP supports IPv6 but not SNI.
Re: CloudFlare enabling free SSL by mid-October
#49Most of the websites wont encrypt the link from Cloudflare to the server, ultimately defeating the purpose of SSL aside from a better search ranking.
What's the difference between this and using AWS ELB for HTTPS termination?
Communication from CloudFlare to your server is over the open Internet, whereas that from an ELB to an EC2 instance is within Amazon's datacentre.
Re: CloudFlare enabling free SSL by mid-October
#50what I just paid 20/month for the SSL.... Update: I have another concern I just found out. For example, I do a lot of web scraping through my domain and I see that I was automatically opted in to use https://www.cloudflare.com/apps/scrapeshield , something that is supposed to block scraping. There's a huge conflict of interest if it turns out that the cloudflare network actively aims to help block scraping. I know yo…
We'll be adding some cool new features to our paid plans at the same time, so I hope you'll decide to continue paying us the $20.
Good to hear - I just signed up and put in the $20 myself (not a very large barrier), and I'm glad features like custom certificates (& other things) will be available as mentioned elsewhere in this thread. CloudFlare seems like a great product so far.