News for hackers. Stuff that matters.

A comment on Celebrating CloudFlare's 4th Birthday.

Re:Celebrating CloudFlare's 4th Birthday by anon1385 on Saturday September 27, 2014 @10:00AM (#8377029)
CloudFlare is the biggest MITM attack in the history of the internet. Why are we putting this much power in the hands of a few US citizens, who are legally obliged to record all that unencrypted data passing through their servers?
[ Parent | on HN ]
Re:Celebrating CloudFlare's 4th Birthday by jgrahamc on Saturday September 27, 2014 @11:26AM (#8377242)
We are not recording the data that passes through our servers.
[ Parent | on HN ]
Re:Celebrating CloudFlare's 4th Birthday by zuck9 on Saturday September 27, 2014 @11:15AM (#8377207)
Most sites which are not on HTTPS now are static sites like blogs etc. Google recently announced HTTPS will be determining SERP so many webmasters are going to use it anyway even with a MITM.
[ Parent | on HN ]
Re:Celebrating CloudFlare's 4th Birthday by tokenizerrr on Saturday September 27, 2014 @11:22AM (#8377230)
> Google recently announced HTTPS will be determining SERP

Seriously? So now I have to buy into the corrupt CA system in order to rank well in searches? :/

[ Parent | on HN ]
Re:Celebrating CloudFlare's 4th Birthday by spindritf on Saturday September 27, 2014 @11:25AM (#8377239)
It's supposed to be a minor ranking signal for now.

http://googleonlinesecurity.blogspot.com/2014/08/https-as-ra...

[ Parent | on HN ]
Re:Celebrating CloudFlare's 4th Birthday by spindritf on Saturday September 27, 2014 @11:23AM (#8377232)
who are legally obliged to record all that unencrypted data

They may be compelled to do that. It was actually a European directive, and subsequent regulations in each member state, that forced providers to retain data pre-emptively, and even that didn't require them to record all traffic.

https://en.wikipedia.org/wiki/Data_Retention_Directive

[ Parent | on HN ]
Re:Celebrating CloudFlare's 4th Birthday by yeahforbes on Saturday September 27, 2014 @11:04AM (#8377183)
I'd be interested in a source pointing out the origin of that obligation. I very much agree that end-to-end encryption is superior for transactions that need it. Some don't need it though, and MITM'd encryption does at least protect the end user from any untrusted parties on their local subnet like in coffee shops, which are far more untrusted than upstream operators.
[ Parent | on HN ]