Hacker News Reader

Comment by jgrahamc | Hacker News Reader

It's easy to use our Strict mode. We'll give you a certificate for the origin for free: https://blog.cloudflare.com/cloudflare-ca-encryption-origin/

Or you can bring your own certificate from someone like Let's Encrypt.

View on HN

If it's that easy, why even have "strict" mode? Why not make the branding less misleading, and rename "Full" to "Weak"?

I'll bring that to the PM responsible.

What's the likelihood of actually seeing a change?

PM here—he's already brought to me to discuss :)

And is tree cert pinning for self-sign veers? If not, why not?

Can you please also include an HTTP response header that tells us the level of verification of the connection to the origin?

If CloudFlare wants to live dangerously with origin connections, fine... but give end users a way to drop the connection if it isn't secure, like our browsers would normally.

By the time you've gotten this response header, the request has already been sent over the connection that you don't trust, and at least part of the response.

But at least you can cease further communications. Feel free to suggest a better idea.

I love your suggestion, with the caveat that browsers send a pre-flight interrogation request (similar to OPTIONS with CORS) to determine if the origin connection is secure before sending a legitimate request (containing potentially sensitive data).

Reminds me of the whole USB 2.0 Full Speed vs USB 2.0 High Speed nonsense from the early 2000s. Raise your hand if you can tell me which one is 480 Mbit/s and which one is 12 Mbit/s without looking it up online.

Full Speed has existed since USB 1.0 — it’s “full” relative to USB 1.0, where the only other option was Low Speed — but I agree that the name was a poor choice.

Rename "Full" to "Weak", and apologize for the crime that was "Flexible"!

You should really reach out to Andy Ellis. Akamai forces cert pinning when HTTPSing back to customer origins for some very good reasons that he can explain to you.

Reply on news.ycombinator.com