Does “www.” Mean Better Transport Layer Security?

Re:Does “www.” Mean Better Transport Layer Security? by segfaultbuserr on Monday August 19, 2019 @06:51AM (#20736668)

Another implication of this result is: even if the transport layer security appears to be secure, it's possible that it only indicates the CDN setup, and the actual upstream servers are insecure.

Which means, a latest and greatest TLSv1.3 server you see may be ultimately backed by a vulnerable TLSv1.0 upstream server (or even unencrypted HTTP!).

Great news for the NSA indeed!

[ Parent | on HN ]

Re:Does “www.” Mean Better Transport Layer Security? by Jestar342 on Monday August 19, 2019 @10:36AM (#20738101)

Disclaimer: Asking from a place of ignorance/naivity

What does this mean for SSL termination? E.g. SSL terminates at cloudflare, internal (behind firewall) all http-sans-s?

[ Parent | on HN ]

Re:Does “www.” Mean Better Transport Layer Security? by psychrometer on Monday August 19, 2019 @11:48AM (#20738796)

That depends on whether that site has Flexible or Full SSL setting enabled.

https://support.cloudflare.com/hc/en-us/articles/200170416-E...

[ Parent | on HN ]

Re:Does “www.” Mean Better Transport Layer Security? by jdfellow on Monday August 19, 2019 @11:19AM (#20738514)

My gut says that such a thing is a bad idea and TLS for internal communications is best practice. Hard to implement though.

[ Parent | on HN ]

Re:Does “www.” Mean Better Transport Layer Security? by newman314 on Monday August 19, 2019 @07:59PM (#20742789)

Hard to implement but I’m slowly dragging org teama into it.

[ Parent | on HN ]