Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by NEDM64 | Hacker News Reader

Parent Full thread

NEDM64·

Free SSL.

Enough reasons for me.

View on HN

Free MitM attack.

Enough reason not to.

https://scotthelme.co.uk/tls-conundrum-and-leaving-cloudflar... https://stirling.co/blog/cloudflare-mitm/

These are posts that always repeat the same thing: don't use Flexible SSL. Fine, that's your choice as the site operator to use or not use that option. Why blame the provider for your configuration choice?

No, they don't. At least one of those posts is specifically about Full SSL, as is my article. You cannot proxy through CloudFlare without an MITM risk, by design. No matter how you configure it.

Just like every other CDN or network service out there that is a proxy. Using a load balancer from a cloud provider that does TLS termination is the same risk. Of course it's by design because that's just how it works. You can't proxy TLS traffic without being MITM.

Please stop repeating the same exact thing instead of actually understanding what you're talking about, it's just misinformation and FUD at this point. You still havent replied to any of the other questions.

Letsencrypt?

TBF that's only just getting started. Sites have been up for a while.

While true, StartCom and WoSign have been around for a while (even if they have some shadiness issues of their own).

I wouldn't necessarily hold it against somebody to have picked CloudFlare because of this in the past, but in 2016 it's simply no longer a reason to keep using CF.

Reply on news.ycombinator.com