Hacker News Reader

Comment by dijit | Hacker News Reader

Get SSL from using a thirdparty MITM?

Not only do they control your DNS they also control all traffic going to your site, also the connection between you and them is not encrypted.

I figured this would be a tutorial for letsencrypt. Cloudflare certainly is an option but it's not one I would recommend for -most- people unless I know why they're opting for SSL. If it's static content then sure- but I don't support cloudflare for dynamic content. I'm responsible for things like passwords and I can't keep that responsibility if I actually choose to MITM my own site with an external company.

Trust doesn't enter into it. I don't trust myself with your password so why would I trust anyone else?

View on HN

Playing Devil's advocate: when you run your site on any provider, except maybe colo'ing, you're also giving them access to that data, as they could peek into the system's memory . Using Cloudflare is just adding a second provider.

Sure, but Google or AWS looking at your specific certs and using them to decrypt your traffic or impersonate you is probably far less likely than someone MITMing Cloudflare's connection to your server or even worse finding a vulnerability in CF (see cloudbleed [1]). I really really dislike how Cloudflare has legitimized MITMing many sites while making it look 'secure'. It's basic security, never trust someone else with your keys.

1: https://en.m.wikipedia.org/wiki/Cloudbleed

> Using Cloudflare is just adding a second provider.

Thus immediately increasing risk by 100%.

In actuality though, even more - if you use the setup where the connection between you and CF is not encrypted. In that case any hop along the way between you and CF could intercept the data.

> Also the connection between you and them is not encrypted

While you are right in that cloudflare won't stop you making this questionable design choice if you want, you shouldn't and you don't have to either.

You can still use cloudflare's ssl certificate AND use letsencrypt/<other cert provider> to secure traffic between cloudflare and your server, ensuring SSL end to end (aside from the obvious MITM stuff cloudflare have to do in order to successfully retrieve content from their caches etc). Cloudflare call this configuration "full" encryption, as opposed to the somewhat terribly named "dynamic" setup you are referring to.

This is one aspect of cloudflare I'm not huge on either, given that when users see an SSL padlock they may have a reasonable expectation their input is at least encrypted until it reaches the destination server (again with the cache MITM caveats and so on) but no one is forcing you to use it that way.

> also the connection between you and them is not encrypted.

The tutorial uses the Full encryption option, which does encrypt the data between your origin server and Cloudflare. You might be thinking of their flexible SSL option?

[EDIT] I might add that for anyone not using GitHub Pages as per the tutorial, they'll need additional steps to get Full SSL working with Cloudflare. It's not effortless.

The problem is CloudFlare offers zero way for an end user to identify if a site is setup with flexible SSL or not. Therefore I have no way of verifying the full path back to the origin.

I brought this up and was told "This is something we are definitely considering." but heard nothing beyond that.

they won't do it as it's one of their major selling points: one click ssl

by offering the "flexible ssl" option at all it seems that they couldn't give a toss whether on not it actually protects anyone

Reply on news.ycombinator.com