News for hackers. Stuff that matters.
Re:Cloudflare’s privacy crusade continues with a challenge t... by saagarjha on Tuesday September 29, 2020 @01:46PM (#24630787)
Flexible SSL/TLS is useful as it truly does provide some of the benefits of a secure connection–it certainly prevents ISP ad injection and casual coffee shop network sniffing–but its major problem is the one you've identified, which is that it's difficult to distinguish from a "true" SSL connection. I suspect the people who are using this feature are doing so because they won't be using a secure connection at all otherwise, not because they are somehow unable to set up Let's Encrypt.
Re:Cloudflare’s privacy crusade continues with a challenge t... by r1ch on Tuesday September 29, 2020 @03:21PM (#24631841)
I've had Flexible SSL default on several times when setting up domains, it's not always a conscious choice. For small businesses who perhaps don't know any better, they move their site to CF, see the green lock in the browser and think everything is fine. It's an extremely dangerous feature and for a security company CF should really be doing better.
Re:Cloudflare’s privacy crusade continues with a challenge t... by Kalium on Tuesday September 29, 2020 @07:23PM (#24634223)
How would you go about helping small businesses who don't know any better do things correctly in a way that would be easy for those with sharply limited technical resources to implement?