Re:Google Will Soon Shame All Websites That Are Unencrypted
by leni536 on Thursday January 28, 2016 @04:29AM
(#10987266)
I wonder how it's even allowed for CF to do this. "your site" <--- http ---> CF <--- https ---> clients is a poor solution and it only hides that the connection is actually not secure. Isn't this a misuse of many CA's TOS and should result in certificate revocation? Maybe I'm wrong though.
[ Parent
| on HN ]
Re:Google Will Soon Shame All Websites That Are Unencrypted
by Zarel on Thursday January 28, 2016 @05:00AM
(#10987348)
Well, at least for several threat models, "your site to CF" is at least slightly better than "CF to clients". It's not vulnerable to things like unsecured wi-fi sniffing. Then again, neither are self-signed certs and for some reason all browsers consider them even worse than no cert.
On the other hand, it doesn't protect against government spying, but then again, I think some governments straight-up MitM HTTPS traffic anyway. For instance: