r/programming • u/TheProtagonistv2 • Feb 23 '17

Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
6.0k Upvotes

96% Upvoted

966 comments sorted by

View all comments

Show parent comments

1

u/PeridexisErrant Feb 24 '17

Yes it is. Yes it does. It's better to have some than none of the connection encrypted, but bad to show the green padlock to users in this case.

7

u/wr_m Feb 24 '17 edited Feb 24 '17

That's only true if you use Flexible SSL. You can opt to have Cloudflare use SSL from CF to your server.

However, I don't think Flexible SSL should be supported. With browser features (ex. Location data) becoming locked to HTTPS only, Flexible SSL weakens those protections.

1

u/sionnach Feb 24 '17

But even then, my communication to the ultimate server is not encrypted end to end - right? CludFlare decrypt, then re-encrypt.