<story><title>CloudFlare, SSL and unhealthy security absolutism</title><url>https://www.troyhunt.com/cloudflare-ssl-and-unhealthy-security-absolutism/</url></story><parent_chain></parent_chain><comment><author>tptacek</author><text>Protection against &amp;quot;passive attacks&amp;quot; is mostly meaningless: if you can observe packets, you can hijack sessions. It&amp;#x27;s only the certificate validation that Cloudflare apparently performs only in &amp;quot;strict&amp;quot; mode that prevents this attack.&lt;p&gt;In particular, the &amp;quot;full&amp;quot; TLS they offer that Hunt is taking advantage of (because he can&amp;#x27;t deploy a working certificate) is grievously insecure: he&amp;#x27;s essentially running his system on top of the equivalent of the &amp;quot;goto fail&amp;quot; vulnerability in Safari that the Internet was (justifiably) freaking out about two years ago.&lt;p&gt;Hunt is smart about a whole lot of things, but he&amp;#x27;s wrong about this. There&amp;#x27;s nothing &amp;quot;unhealthy&amp;quot; about the absolutism here: you either have end-to-end cryptographic security, or you&amp;#x27;re vulnerable.</text></comment>
<story><title>CloudFlare, SSL and unhealthy security absolutism</title><url>https://www.troyhunt.com/cloudflare-ssl-and-unhealthy-security-absolutism/</url></story><parent_chain></parent_chain><comment><author>lmm</author><text>Not wanting the green padlock in the URL bar when traffic is being sent unencrypted and unauthenticated over the open internet is not unhealthy absolutism. It&amp;#x27;s a basic necessity if the green padlock is to mean anything at all.&lt;p&gt;It is of course theoretically possible for any site operator to pass information that was submitted securely, insecurely over the open internet. It probably happens, and we should look for ways to eliminate that possibility. But the fact that we can&amp;#x27;t eliminate all the possible ways that might happen is not a good reason for CloudFlare to make it very easy for site operators to do.&lt;p&gt;&amp;quot;Flexible&amp;quot; does prevent a small class of attacks that are possible against plain HTTP. But it does so at the cost of completely invalidating HTTPS URLs, padlock icons and so forth. Making it easier for small site operators to get a bit of security against the most simplistic attacks is not worth making it impossible for users who are serious about security to have good security. Worse, the benefits accrue to CloudFlare and their customers, but the costs are shared by all internet users. It is an antisocial practice and it needs to stop.</text></comment>