New Tools for Detecting HTTPS Interception

Re:New Tools for Detecting HTTPS Interception by tgsovlerkhgsel on Monday March 18, 2019 @04:32PM (#19424961)

Just a note, unless you're also validating the Host: header (and possibly even then), Authenticated Origin Pull can be bypassed if someone does find the right server:

https://medium.com/@ss23/leveraging-cloudflares-authenticate...

(Could have been fixed in the past couple months, but I doubt it.)

Same for Access, by the way.

[ Parent | on HN ]

Re:New Tools for Detecting HTTPS Interception by prdonahue on Monday March 18, 2019 @05:13PM (#19425379)

Sometime in 2Q you'll be able to upload your own client certificate (issued under your own CA if you like) to be used with Authenticated Origin Pulls.

[ Parent | on HN ]

Re:New Tools for Detecting HTTPS Interception by rarecoil on Tuesday March 19, 2019 @12:47AM (#19428137)

Note: This user is a (the?) Director of Product at Cloudflare.

[ Parent | on HN ]

Re:New Tools for Detecting HTTPS Interception by zackbloom on Monday March 18, 2019 @06:45PM (#19426114)

You can also use Argo Tunnel to create a secure tunnel between your origin and Cloudflare.

[ Parent | on HN ]