Turns out half the internet has a single-point-of-failure called “Cloudflare”

Re:Turns out half the internet has a single-point-of-failure... by snowwrestler on Monday July 20, 2020 @03:37PM (#23901127)

Unless you're sending all your traffic back to physical machines that you own locked into a cage in a datacenter, you are probably letting someone MITM your SSL traffic. For example if you are hosting on AWS, Amazon has access to your keys. If you are hosting on a hardware server leased from Hetzner, Hetzner has access to your keys.

When a 3rd party has access to your keys, their responsibilities to you are spelled out in your contract with them. That's true for CDNs as well as hosting companies.

[ Parent | on HN ]

Re:Turns out half the internet has a single-point-of-failure... by sjy on Monday July 20, 2020 @06:20PM (#23902483)

There’s a difference between a VM host with the technical ability to carry out a targeted MITM attack against its customers using hardware-level access, and a provider that sells MITM as a service.

[ Parent | on HN ]

Re:Turns out half the internet has a single-point-of-failure... by zzzcpan on Monday July 20, 2020 @05:19PM (#23902021)

It's more complicated.

For most websites today if someone can intercept traffic somewhere close to the server they don't even need the keys, they can just fake responses to pass CA validation and issue valid certificates with their own keys and MITM like there is no encryption.

And coldboot attacks performed by a hosting provider staff of dumping memory and finding keys isn't that realistic of a threat, just like putting servers into a locked cage on someone else's property isn't much of a protection.

[ Parent | on HN ]

Re:Turns out half the internet has a single-point-of-failure... by henriquez on Monday July 20, 2020 @05:54PM (#23902305)

I send traffic for my sites and apps to physical machines that I own and operate in a secure location, but I doubt most people are doing this.

[ Parent | on HN ]