ProtonMail pays $6k ransom, gets taken out by DDoS anyway

Re:ProtonMail pays $6k ransom, gets taken out by DDoS anyway by dangrossman on Saturday November 07, 2015 @09:21PM (#10527123)

Cloudflare's $200/month business plan includes DDoS mitigation. It's self-serve and there's an "I'm Under Attack!" button in every account. There's no extra cost for the bandwidth.

[ Parent | on HN ]

Re:ProtonMail pays $6k ransom, gets taken out by DDoS anyway by ymse on Saturday November 07, 2015 @10:27PM (#10527319)

So $6000 would get them over two years of self-service DDoS mitigation. Ouch.

[ Parent | on HN ]

Re:ProtonMail pays $6k ransom, gets taken out by DDoS anyway by Kimm0n0 on Saturday November 07, 2015 @10:53PM (#10527391)

If you are in the privacy business, a man-in-the-middle like CloudFlare, is not the thing you try first.

[ Parent | on HN ]

Re:ProtonMail pays $6k ransom, gets taken out by DDoS anyway by vemv on Sunday November 08, 2015 @02:24AM (#10527848)

Really? Do men-in-the-middle matter if your communications are encrypted (be it HTTPS, PGP)?

[ Parent | on HN ]

Re:ProtonMail pays $6k ransom, gets taken out by DDoS anyway by dangrossman on Sunday November 08, 2015 @02:54AM (#10527893)

In this case yes, because users don't get an encrypted channel with the site's servers, only with Cloudflare. Cloudflare isn't acting as a dumb TCP proxy which would allow that. When it hosts an HTTPS website, it does so by terminating the HTTPS connections itself. Cloudflare has the private key, and can see the content of every request/response. That's necessary to compress images, inject scripts, minify code and do all the other optimization/CDN stuff they do -- but it also means making them an MITM between a site and its users.

[ Parent | on HN ]