Re:Cloudflare Introduces Automatic SSL/TLS
by xyzzy123 on Thursday August 08, 2024 @05:45PM
(#41196648)
It already happened once, remember this? https://blog.cloudflare.com/incident-report-on-memory-leak-c...
(Aka CloudBleed https://en.m.wikipedia.org/wiki/Cloudbleed)
The re-encrypted part isn't necessarily true though and you have no way of knowing. Users are misled because they see a nice secure lock icon in the browser, but that only protects the connection to the local Cloudflare POP, the rest of the way to the origin is all vulnerable to MITM.
As a security company, anything less than "Full (Strict)" should not exist.
Re:Cloudflare Introduces Automatic SSL/TLS
by telgareith on Friday August 09, 2024 @09:28AM
(#41201623)
Cloudflare publishes a certificate pair you can pin to your origin servers.
They also offer CloudflareD (Tunnels, formerly Argo), which connects origin directly to their network- so no chance of interception or Bypassing their services.
So, as long as it's set up correctly- theres no opportunity to MitM between Origin and Cloudflare.
Do people set it up correctly? I doubt it. I've seen several companies think they were using CF's WAF product, when all they really setup was DNS.
Is this a huge security problem? Yes, it probably will be, some day. But it is what it is, they don't mislead users about the fact that traffic gets decrypted and re-encrypted.