Hacker News Reader

Comment by londons_explore | Hacker News Reader

Great. Next can cloudflare stop providing Https to the user (giving the impression of security) when the connection back to the origin isn't strict HTTPS and is often plaintext?

View on HN

It is more secure (though not end-to-end secure, of course) from the PoV of most threat models because the monitoring most are most concerned about is at their side of the connection (“local infra (often wireless) -> through ISP -> …” or “local -> through ISP -> through state/org level monitoring -> …”).

Tracking you by monitoring the network traffic between CF (or other connection aggregator) and the origins is possible, but usually significantly more effort. Those with reason to be concerned about true end-to-end encryption will know that seeing any CF artefacts means they need to investigate to know if they are getting e2ee or just end-to-proxy.

At a minimum I'd like cloudflare to mark such traffic in some way, and browsers to put a little cross through the "Https" indicator to show the traffic is passing unencrypted across the internet.

That is not a small “minimum”. There are places in the certificate format that a new flag can go, but then all browsers and apps that perform https requests need to be altered to display this in a manner that is:

• consistent • not overly serious, so users who end up trained to ignore this new signal don't automatically ignore more significant warnings • (and this is the fun part) communicate this new semaphore signal to the general public without confusing them…

To head off one cynical question: “Why worry about the general public when they wouldn't care anyway and just click through warnings with wreckless abandon already?” - if not the general public then who would this be for? Those who might need to care are already checking if their data is going through CF and so might not to under true E2EE.

They can just add an http header that browsers and browser plugins can listen for, they already add `cf-cache-status: HIT`, so they could add this too:

    cf-http-endpoint: 1

or if you want it to match their own terminology[0], it could be:

    cf-encryption-mode: off/flexible/full/full-strict/strict

[0]: https://developers.cloudflare.com/ssl/origin-configuration/s...

Reply on news.ycombinator.com