<story><title>CloudFlare, SSL and unhealthy security absolutism</title><url>https://www.troyhunt.com/cloudflare-ssl-and-unhealthy-security-absolutism/</url></story><parent_chain><item><author>tptacek</author><text>Protection against &amp;quot;passive attacks&amp;quot; is mostly meaningless: if you can observe packets, you can hijack sessions. It&amp;#x27;s only the certificate validation that Cloudflare apparently performs only in &amp;quot;strict&amp;quot; mode that prevents this attack.&lt;p&gt;In particular, the &amp;quot;full&amp;quot; TLS they offer that Hunt is taking advantage of (because he can&amp;#x27;t deploy a working certificate) is grievously insecure: he&amp;#x27;s essentially running his system on top of the equivalent of the &amp;quot;goto fail&amp;quot; vulnerability in Safari that the Internet was (justifiably) freaking out about two years ago.&lt;p&gt;Hunt is smart about a whole lot of things, but he&amp;#x27;s wrong about this. There&amp;#x27;s nothing &amp;quot;unhealthy&amp;quot; about the absolutism here: you either have end-to-end cryptographic security, or you&amp;#x27;re vulnerable.</text></item></parent_chain><comment><author>jgrahamc</author><text>It&amp;#x27;s easy to use our Strict mode. We&amp;#x27;ll give you a certificate for the origin for free: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.cloudflare.com&amp;#x2F;cloudflare-ca-encryption-origin&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.cloudflare.com&amp;#x2F;cloudflare-ca-encryption-origin&amp;#x2F;&lt;/a&gt;&lt;p&gt;Or you can bring your own certificate from someone like Let&amp;#x27;s Encrypt.</text></comment>
<story><title>CloudFlare, SSL and unhealthy security absolutism</title><url>https://www.troyhunt.com/cloudflare-ssl-and-unhealthy-security-absolutism/</url></story><parent_chain><item><author>tptacek</author><text>Protection against &amp;quot;passive attacks&amp;quot; is mostly meaningless: if you can observe packets, you can hijack sessions. It&amp;#x27;s only the certificate validation that Cloudflare apparently performs only in &amp;quot;strict&amp;quot; mode that prevents this attack.&lt;p&gt;In particular, the &amp;quot;full&amp;quot; TLS they offer that Hunt is taking advantage of (because he can&amp;#x27;t deploy a working certificate) is grievously insecure: he&amp;#x27;s essentially running his system on top of the equivalent of the &amp;quot;goto fail&amp;quot; vulnerability in Safari that the Internet was (justifiably) freaking out about two years ago.&lt;p&gt;Hunt is smart about a whole lot of things, but he&amp;#x27;s wrong about this. There&amp;#x27;s nothing &amp;quot;unhealthy&amp;quot; about the absolutism here: you either have end-to-end cryptographic security, or you&amp;#x27;re vulnerable.</text></item></parent_chain><comment><author>type0</author><text>&amp;gt; There&amp;#x27;s nothing &amp;quot;unhealthy&amp;quot; about the absolutism here: you either have end-to-end cryptographic security, or you&amp;#x27;re vulnerable.&lt;p&gt;I&amp;#x27;m not sure why he talks about absolutism, where this usage basically invalidates the whole point of TLS. This seems like an after-rationalization on why he chose to use CloudFlare, there is much more reasons not to use them. In the end of course it depend on what type of site you use it for.</text></comment>