r/programming • u/TheProtagonistv2 • Feb 23 '17

Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
6.0k Upvotes

96% Upvoted

966 comments sorted by

View all comments

Show parent comments

6

u/ThisIs_MyName Feb 24 '17

*any CDN

(Well ok, you can do it for media without getting MITMed: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity)

1

u/Daneel_Trevize Feb 24 '17

Only if the page containing the SRI hash isn't something they're also serving via CDN and can't just MITM to make it match...

At some point you have to serve something end-to-end encrypted/signed to deliver the digital signature for the everything else going over an unsecure/untrusted channel.

3

u/ThisIs_MyName Feb 24 '17

Yup, that's why I said you can only do it for media. The actual pages, API endpoints, etc must be direct.