CloudFlare enabling free SSL by mid-October

Post by gcarre » Thu, Aug 07, 2014, 10:28 PM UTC

nilved wrote: post #35

monokrome wrote: post #28

Earlier quoted context omitted.

So, you're saying that using HTTP instead of HTTPS doesn't increase the privacy of users? I'd say that it does "increase" the privacy, although nobody is saying that it fixes every hole in the boat...

Speaking strictly, you're right, but when you consider (a) Cloudflare's connection to your server is insecure (b) Cloudflare is listening in on every request (c) Cloudflare blocks VPN and Tor users, it doesn't seem like such an obvious decision. But that's a false dichotomy, since everybody should use HTTPS, nobody should use HTTP, and, most importantly, nobody should be okay with third-parties snooping on your users…

Post by agwa » Thu, Aug 07, 2014, 10:37 PM UTC

eastdakota wrote: post #13

agwa wrote: post #10

Earlier quoted context omitted.

It would be free, but not necessarily easy, as it would still entail configuring your web server to use SSL, and that might not even be an option if you're using shared hosting. (Aside: self signed certs don't protect the connection from active attacks unless CloudFlare pins the cert. I'm mainly concerned with passive eavesdropping though.)

That's what we're going to do: issue certs that our customers can use on their origins, that will be trusted by our network, and that will be pinned to a particular site. That will allow end-to-end cryptographic connections. There are other groups working on making installing and setting up SSL on origin servers easier, that's not something we're likely to tackle, but agree it's important.

Post by oceanstone » Thu, Aug 07, 2014, 11:14 PM UTC

rdl wrote: post #42

nilved wrote: post #18

Please note that using Cloudflare, even with free SSL, is not an increase to the security and privacy of your users. On the contrary, Cloudflare records information about your users (this cannot be disabled) and, by default, blocks users who attempt to view your site through privacy-enhancing software. I would suggest that people looking to install SSL on their website (this should be everybody) instead get their fre…

I assume you are referring to Tor? We love Tor and the specific things we block by default are resource consumption bots. If people enable. "I Am Under Attack" mode , I think there is some incidental interstitial challenge for Tor, but not blocked. We don't comment on our customers unless they authorize us to, but based on the list of public ones, I would be pretty comfortable, even if I didn't work there.

Post by p1mrx » Thu, Aug 07, 2014, 11:36 PM UTC

otterley wrote: post #48

asdfaoeu wrote: post #44

Earlier quoted context omitted.

Non-SNI over ipv6 seems pretty pointless since anything supporting ipv6 is going to have sni anyway.

Not true; Windows XP supports IPv6 but not SNI.

Post by nilved » Fri, Aug 08, 2014, 12:22 AM UTC

oceanstone wrote: post #55

rdl wrote: post #42

Earlier quoted context omitted.

I assume you are referring to Tor? We love Tor and the specific things we block by default are resource consumption bots. If people enable. "I Am Under Attack" mode , I think there is some incidental interstitial challenge for Tor, but not blocked. We don't comment on our customers unless they authorize us to, but based on the list of public ones, I would be pretty comfortable, even if I didn't work there.

Anyone here can test nilved 's claim easily enough. Just visit Hacker News using Tor or a VPN, since the site uses Cloudflare. Side note: Your announcement is really exciting.