Re:ProtonMail pays $6k ransom, gets taken out by DDoS anyway
by Kimm0n0 on Saturday November 07, 2015 @10:53PM
(#10527391)
If you are in the privacy business, a man-in-the-middle like CloudFlare, is not the thing you try first.
[ Parent
| on HN ]
Re:ProtonMail pays $6k ransom, gets taken out by DDoS anyway
by vemv on Sunday November 08, 2015 @02:24AM
(#10527848)
Really? Do men-in-the-middle matter if your communications are encrypted (be it HTTPS, PGP)?
Re:ProtonMail pays $6k ransom, gets taken out by DDoS anyway
by dangrossman on Sunday November 08, 2015 @02:54AM
(#10527893)
In this case yes, because users don't get an encrypted channel with the site's servers, only with Cloudflare. Cloudflare isn't acting as a dumb TCP proxy which would allow that. When it hosts an HTTPS website, it does so by terminating the HTTPS connections itself. Cloudflare has the private key, and can see the content of every request/response. That's necessary to compress images, inject scripts, minify code and do all the other optimization/CDN stuff they do -- but it also means making them an MITM between a site and its users.