News for hackers. Stuff that matters.

A comment on V8 Release 5.1. Parent comment

Re:V8 Release 5.1 by manojlds on Saturday April 23, 2016 @11:47AM (#11556014)
Yeah, the free version is HTTPS only between client and CF.

I made my blog hosted on Github HTTPS with this, mainly so that I can experiment some features like Service Workers.

[ Parent | on HN ]
Re:V8 Release 5.1 by adrianmacneil on Saturday April 23, 2016 @12:35PM (#11556210)
Source? Last time I used it you could encrypt both hops (although you obviously need to tell CF to ignore the cert mismatch for backend server).
[ Parent | on HN ]
Re:V8 Release 5.1 by gkop on Saturday April 23, 2016 @12:53PM (#11556302)
Yes, I use free CF with both hops encrypted. There's no way for my visitors to know this though. IMO CF should require both hops be encrypted.
[ Parent | on HN ]
Re:V8 Release 5.1 by kevincox on Saturday April 23, 2016 @08:15PM (#11557980)
They are both encrypted but since you can't verify the "server" certificate it is vulnerable to MITM.
[ Parent | on HN ]