News for hackers. Stuff that matters.

A comment on Use LetsEncrypt and CloudFlare to secure any Heroku app for free. Parent comment

Re:Use LetsEncrypt and CloudFlare to secure any Heroku app f... by xxdesmus on Thursday July 21, 2016 @09:57AM (#12136833)
Welcome to the internet -- what you actually just said was:

"[The Cloud] is essentially a consensual man-in-the-middle and for certain threat models is not compatible with the 'secure' modifier."

[ Parent | on HN ]
Re:Use LetsEncrypt and CloudFlare to secure any Heroku app f... by CiPHPerCoder on Thursday July 21, 2016 @10:05AM (#12136892)
That's simultaneously wrong and misleading.

"The Cloud" isn't a company that has direct access to a certificate authority.

"The Cloud" doesn't produce a valid TLS certificate for YOUR website, to encrypt the connection between them and your visitors, but not necessarily between them and your server.

"The Cloud" is a vague term for "other people's computers".

CloudFlare is better than plaintext HTTP, but if your goal is confidentiality, then CloudFlare is probably worse than direct HTTPS with no intermediaries.

Again, threat models differ. For most people, CloudFlare is probably just fine.

[ Parent | on HN ]