Hacker News Reader

Comment by vader1 | Hacker News Reader

I understand that there are many different types of DDOS attacks, and that for some of them having access to the content on the application level makes your job of mitigating them a lot easier.

But even without that, would comparing the encrypted traffic patterns for an individual client to other client's patterns (or to that client's traffic to one of the other 2 million Cloudflare websites); and analyzing the encrypted traffic as in [1] not still give you a wealth of information to use? It might have made for a much more rewarding two years of development: even if such a setup would be slightly less effective at mitigating DDOS', it would be infinitely better in terms of privacy and trust.

[1] http://arxiv.org/abs/1403.0297

View on HN

In some ways what you propose sounds even scarier, i.e. figure out the best way to look inside SSL encrypted data without having the key.

But in terms of privacy and trust, CloudFlare is already in the position of terminating SSL connections and establishing new ones to origin web servers. We take the protection of that data and the associated keys very seriously. There will be more announcements over the coming weeks and months about how we secure things.

I'm not quite following how having just enough insights about the encrypted data to perform DDOS mitigation would be scarier than having full read- and write access to the cleartext. Thanks for the responses though, and definitely looking forward to those blogs.

You are implying something fundamental: that the encrypted traffic could be adequately analysed for insight without the need for decryption.

Yet to do so would be to defeat SSL itself, or at least to declare it as insufficient to adequately protect secrets.

What CloudFlare is doing isn't defeating SSL or any kind of attack on it. They are merely working around some prior limitations on requiring access to an organisation's private key.

As a proxy that is charged with DDoS protection (and other types of protection and performance improvements), they are being asked to terminate and work on the unencrypted data to a very strict set of complience by the end organisations, but they need to do this in a way that does not involve possessing or having access to the private key.

Their solution works extremely well given the multiple constraints (technological and legal) that they have.

  > You are implying something fundamental: that the encrypted traffic could be adequately analysed for insight without the need for decryption.
  > Yet to do so would be to defeat SSL itself, or at least to declare it as insufficient to adequately protect secrets.

This is possible through HTTPS traffic analysis, see [0] and [1] for starters. Of course, it's much easier for Cloudflare to do analysis for DDoS protection if they have access to plaintext.

Whether this means that SSL is, as you say, "insufficient to adequately protect secrets" is an interesting discussion to have.

[0] http://arxiv.org/pdf/1403.0297.pdf

[1] http://blog.ioactive.com/2012/02/ssl-traffic-analysis-on-goo...

Reply on news.ycombinator.com